Enable service-identity-based Azure blob authentication

Currently, `Corvus.Azure.Storage.Tenancy` uses account keys to authenticate to Azure Storage. We should add support for using managed identities instead.

Azure storage supports AAD-based authentication for blob access. This offers a couple of advantages over the current account key based approach:

* Avoids key management issues
* Supports principle of least privilege

Regarding key management, services using `Corvus.Tenancy` on top of Azure storage often introduce an Azure Key Vault purely to hold the storage account key. Not only does this mean extra complication in the Azure deployment (the need to deploy a key vault, and also the need to populate it with the correct key), it also introduces the ongoing overhead of key rotation management—each time we update the storage account keys, we also need to update the relevant secret in Azure Key Vault.

If instead a service can use its Managed Identity to obtain access to the storage account, there is no need for that service ever to have access to the storage account key. The secrets involved in Managed Identity are local to the relevant service, and Azure takes care of updating them.

Regarding the principle of least privilege, a big problem with using an Azure Storage account key is that it is all-powerful. There is no way to provide a lesser key that provides access only to what is required. (There are SAS tokens, but something still has to generate those, and that something needs the full account key.) But when you authenticate via AAD, Azure Storage offers more fine-grained options, through the various roles it defines. (E.g., if applications choose to use the model in which individual services communicate directly with the tenancy store, instead of going via the `Marain.Tenancy` service, AAD-based auth would make it possible to grant those applications read-only access, something we can't do with the current storage key based approach.)