Support registries management - managed identity

Extend functionality in #98 to support connecting to registries using managed identity.

I think most VS Code users will be happy with using the container app's system-assigned identity, so let's optimize for that. This means:

• Make it easy to use system-assigned identity
• Make it possible to use a user-assigned identity, but that identity must be first enabled in the container app using some other means (ARM, CLI, portal)

Proposed changes:

• In registry credentials, allow create/update of registry entries (ACR only) that use a system or user assigned managed identity
  • System-assigned: user can select "system assigned", if it is not enabled in the app, enable it automatically
  • User-assigned: user can select a user assigned identity that has already been enabled in the app
  • When creating/updating registry entries with manage identities, ensure the identity has AcrPull permissions to the ACR
• When updating a container image
  • If user selects an ACR, and the ACR matches a registry credential that's been configured to use managed identity, do not set it up with username/password auth.
  • If user selects an ACR but there's no registry credential set up for the ACR, ask if it should be set up using username/password or managed identity. If MI, allow them to select system or user assigned, and automatically try to grant the AcrPull role.
• Allow a user to switch an existing registry credential between username/password and managed identity.

When creating a container app, there's a chicken/egg problem because the app needs to be created first before the identity is available to grant permissions to, but the app can't be created successfully if the permissions aren't set up. I think we should tackle this in another issue.

Start by reading issue #98 and tracing the registry credentials and container image update flows in the extension. Map the proposed system-assigned and user-assigned managed identity scenarios, including AcrPull permission handling and switching existing credentials. Done means the listed registry-management and image-selection cases work, while the container-creation chicken-and-egg case remains out of scope.