`aspire deploy`: no way to set tags on the auto-created Azure resource group (hardcoded to `aspire=true`)

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

I am trying to run `aspire deploy` against an Azure subscription that enforces governance via Azure Policy — every resource group must carry an `owner` tag (cost attribution, ownership, cleanup automation), and creation is **denied** without it. The deploy fails at the `create-provisioning-context` step because Aspire creates the resource group with no way to supply that tag:

```
✗ Failed to create resource group 'rg-...': Error code = RequestDisallowedByPolicy,
Message = Resource 'rg-...' was disallowed by policy. Reasons: 'An `owner` tag is
required on every resource group ...'
```

The provisioner hardcodes the resource group's tags to `{ "aspire": "true" }`, and nothing in the public API or configuration lets me add to them. So there is no supported way to satisfy the policy through Aspire.

### Describe the solution you'd like

A supported way to set tags on the resource group Aspire creates. Sensible default is to merge with `aspire=true`, but full control — including overriding or removing `aspire=true` — should be supported too. Either (or both) of:

- **Config-bindable:** `AzureProvisionerOptions.Tags`, e.g. `Azure:Tags:owner=me@example.com`, applied to the `ResourceGroupData` before create.
- **Builder API:** e.g. `builder.AddAzureEnvironment().WithResourceGroupTags(...)` / `.WithResourceGroupTag("owner", "...")`.

**Alternatives considered:**
- Pre-create the RG with the tag and point Aspire at it via `Azure:ResourceGroup` — works (the provisioner reuses an existing group and skips the create), but defeats the purpose of `aspire deploy` managing the group, and requires an out-of-band `az` step.
- `ConfigureInfrastructure` — only reaches resources *inside* the RG, not the RG itself.

### Additional context

**Versions:** Aspire.AppHost.Sdk 13.4.0 · Aspire.Hosting.Azure 13.4.0 · Aspire.Hosting.Azure.AppContainers 13.4.0

The hardcoded tag, from decompiling `BaseProvisioningContextProvider.CreateProvisioningContextAsync`:

```csharp
ResourceGroupData val = new ResourceGroupData(location);
val.Tags.Add("aspire", "true"); // only tag; no way to add more
resourceGroups.CreateOrUpdateAsync(WaitUntil.Completed, resourceGroupName, val, cancellationToken);
```

`AzureProvisionerOptions` exposes only `SubscriptionId`, `Location`, `ResourceGroup`, `AllowResourceGroupCreation`, `ResourceGroupPrefix`, `TenantId` — no tags. `AddAzureContainerAppEnvironment` / `AddAzureEnvironment` expose only `WithLocation` and `WithResourceGroup`.

**Repro:**
1. Target a subscription with a `deny`-effect policy requiring a tag (e.g. `owner`) on `Microsoft.Resources/resourceGroups`.
2. `aspire deploy` an AppHost using `AddAzureContainerAppEnvironment`.
3. Deploy fails at `create-provisioning-context` with `RequestDisallowedByPolicy`.