There needs to be two different types of "dry-run" in ImageBuilder

The `--dry-run` global CLI option is inconsistent. There are two use cases I'm thinking about:
1. As a container image maintainer, I want to be able to run things like the ACR cleanup pipeline in dry-run mode, against production data, *with full authentication* -- so that I can be sure what action will be taken before anything is deleted. This is "no side effects mode".
2. As the maintainer of ImageBuilder, I want to have some commands run in public PR validation *without authentication* to make sure that a pull request hasn't broken our pipelines. This is "no permissions mode"

Both are valid but distinct scenarios. Having both contained under the `--dry-run` flag is inconsistent.

I propose that `--dry-run` should just be #1 or we should change this functionality to be enum-based.