Can't assign roles like 'Foundry User' to Foundry project resource for Foundry Memory

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

In order to use [Foundry Memory](https://learn.microsoft.com/en-us/azure/foundry/agents/concepts/what-is-memory?tabs=conversational-agent), it seems you need 'Foundry User' permission assigned to the foundry project in order for it to work. The role isn't in the 'CognitiveServicesBuiltInRole' collection, and doing ```var foundryUserRole = (CognitiveServicesBuiltInRole)"53ca6127-db72-4b80-b1b0-d745d6d5456d";``` and assigning it to the project using ```foundry.AddProject(Config.AIFoundryProjectName).WithRoleAssignments(foundryUserRole)``` doesn't seem to work so needs a work around.

Co-pilot's comments in the work around probably describe it better than I do:

```csharp
// "Foundry User" (role id 53ca6127-db72-4b80-b1b0-d745d6d5456d) has no named member in
// CognitiveServicesBuiltInRole yet - the struct has an implicit string conversion, so the raw
// role GUID can be passed directly until the SDK adds a friendly name for it.
var foundryUserRole = (CognitiveServicesBuiltInRole)"53ca6127-db72-4b80-b1b0-d745d6d5456d";

var project = foundry.AddProject(Config.AIFoundryProjectName)
// The Foundry Memory service authenticates as the *project's own* system-assigned managed
// identity when it calls back into the embedding deployment (this is a real Entra hop, not
// implicit same-account access) - grant that identity access to the account. Note:
// WithRoleAssignments does NOT work for the project's own identity, because Aspire's role
// assignment builder only wires up role assignments for resources that reference the target
// via environment variables/args (containers, ProjectResource, etc.) - the Foundry project
// resource itself is never a valid *source* for WithRoleAssignments, so it's silently a no-op.
// Instead, hook into ConfigureInfrastructure (which Aspire combines with its own internal
// callback) to grab the already-provisioned project's managed identity and create the role
// assignment directly against the parent Foundry account using the typed Bicep CDK.
.ConfigureInfrastructure(infra =>
{
var account = (CognitiveServicesAccount)foundry.Resource.AddAsExistingResource(infra);
var cogProject = infra.GetProvisionableResources().OfType().Single();

// Build the RoleAssignment manually (rather than via CreateRoleAssignment) because that
// helper derives its Bicep identifier from CognitiveServicesBuiltInRole.GetBuiltInRoleName,
// which falls back to the raw role GUID for roles without a named member - and GUIDs
// contain hyphens, which aren't valid in Bicep identifiers.
var roleAssignment = new RoleAssignment("foundry_project_foundry_user_role")
{
Name = BicepFunction.CreateGuid(account.Id, cogProject.Id, foundryUserRole.ToString()),
Scope = new IdentifierExpression(account.BicepIdentifier),
PrincipalType = RoleManagementPrincipalType.ServicePrincipal,
PrincipalId = cogProject.Identity.PrincipalId,
RoleDefinitionId = BicepFunction.GetSubscriptionResourceId("Microsoft.Authorization/roleDefinitions", foundryUserRole.ToString())
};
infra.Add(roleAssignment);
});
```

### Expected Behavior

Need to be able to assign these roles (and perhaps there a case for this one to be a sensible default? Not sure why my project needs permission to talk to it's own memory)

### Steps To Reproduce

I have a repo trying various aspire + foundry hosted agent + conversations + memory + ag-ui + devUI + blazor front end here:

https://github.com/[ecoDriverltd/FoundryAgentsExperiment](https://github.com/ecoDriverltd/FoundryAgentsExperiment)

And [an Integration test trying out conversation history and memory](https://github.com/ecoDriverltd/FoundryAgentsExperiment/blob/master/FoundryAgentsExperiment.IntegrationTests/AgentChatTests.cs)

### Exceptions (if any)

_No response_

### Aspire doctor output

Aspire Environment Check
========================

Aspire
✅ Aspire CLI version 13.4.6 (channel: stable)

AppHost
✅ AppHost version 13.4.6 (ecoDriverWeb.AppHost\ecoDriverWeb.AppHost.csproj)

.NET SDK
✅ .NET 10.0.400-preview.0.26322.102 installed (x64)

Container Runtime
✅ Docker v29.6.2: running (auto-detected (default)) ← active

Environment
✅ HTTPS development certificate is trusted

Summary: 5 passed, 0 warnings, 0 failed

Aspire CLI Installations
========================

╭───────────────────────────────────────────────┬──────────────────────────────────────────────┬──────────────┬──────────────┬─────────────╮
│ Path │ Version │ Channel │ Route │ PATH status │
├───────────────────────────────────────────────┼──────────────────────────────────────────────┼──────────────┼──────────────┼─────────────┤
│ C:\Users\MatthewPaul\.aspire\bin\aspire.exe │ 13.4.6+87fe259e4fc244c599019a7b1304c85a1488f │ stable │ script │ active │
│ (current) │ 248 │ │ │ │
│ C:\Users\MatthewPaul\.dotnet\tools\aspire.EXE │ (not probed) │ (not probed) │ (not probed) │ shadowed │
╰───────────────────────────────────────────────┴──────────────────────────────────────────────┴──────────────┴──────────────┴─────────────╯

### Anything else?

_No response_

Start with CognitiveServicesBuiltInRole, AddProject, WithRoleAssignments, and ConfigureInfrastructure, then reproduce the behavior using the linked FoundryAgentsExperiment integration test AgentChatTests.cs. Done means the Foundry project can receive the required Foundry User role and Foundry Memory works without the issue's manual role-assignment workaround.

Written by the indexing model from the issue text.