claims_map isn't useful for Microsoft Azure users - also, hard to restrict by role within SQL when not using Postgres roles and global config variables

This ticket is a placeholder to suggest that a `claims_map` example for Azure AD JWT authentication would be useful, though it's not impossible to figure out, maybe, and that part of the documentation is at odds with how one can actually go about implementing such a thing.

Authentication by JWT docs say:

> When your auth server generates the JWT, the custom claims in the JWT must contain the following:
>
> A x-hasura-default-role field : indicating the default role of that user i.e. the role that will be used in case x-hasura-role header is not passed.
> A x-hasura-allowed-roles field : a list of allowed roles for the user i.e. acceptable values of the x-hasura-role header. The x-hasura-default-role specified should be a member of this list.

The problem I have is with "The x-hasura-default-role specified should be a member of this list." because by default, the `roles` claim is only returned if a user has been manually assigned into a role.

So we have a bit of a problem when using Azure AD by default, without any preview functionality.

Here's how I'd like it to work:
* We can make requests without tokens, these are treated by Hasura as "anonymous" group requests.
* We can make requests with tokens that have no "roles" in the claim to use as allowed-roles, these must be treated as "default" group.
* And we can make requests with tokens that have "roles" in the claim to use as allowed-roles, and still add a default group separate from the allowed group.

But we can't actually do what I just wrote above, according to the docs (I'm about to test it now), because the "default" role is almost always never in the `roles` list -- in fact roles in the Azure AD claim is often not returned unless roles are manually assigned in advance in an admin panel - because to Azure, a default role doesn't exist once custom roles are created, and the default role never was returned even before custom roles were created. There's no such thing as a default role unless you flip on preview stuff I think where maybe you can then modify the claims at an additional cost?, but I can't even find the docs for that right now. You can have people in a certain group self-register an enterprise application and thus have them put in a group that way, but that's about it.

So the docs, earlier, saying "The x-hasura-default-role specified should be a member of this list." is wishful thinking if trying to use Azure JWTs un-modified with custom app roles assigned by Azure AD?

Start with the Authentication by JWT documentation and the Azure AD claims behavior described in this issue. Clarify whether the documentation or claims_map example should explain Azure tokens without a default role, and define the supported configuration and expected role behavior as the completion criteria.

Written by the indexing model from the issue text.