Improve default managed identities handling

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

When we use Aspire with ACA it creates a default managed identity for each service and grants it the required role assignments. We sometimes need those identities to access additional resources, and grant external permissions (e.g. using a FIC). The problem arises when we want to use the explicitly use MI in the AppHost for other things, like pass its client ID to another service in the ACA environment.

The way to do that is to call `builder.AddAzureUserAssignedIdentity()`, but if the app has already been deployed that would create another MI which creates problems:
* We need to reapply those external permissions.
* There's a leftover unused MI with role assignments.
* Closely related - if we want to add an additional MI to an existing service - assigning it basically removes the default one.

### Describe the solution you'd like

It would be useful to have methods like:

```cs
IResourceBuilder GetDefaultManagedIdentity(this IResourceBuilder builder);

IResourceBuilder WithAdditionalUserAssignedIdentity(this IResourceBuilder builder, IResourceBuilder identityResourceBuilder);
```

### Additional context

_No response_