Add managed identity to Cognitive Services (OpenAI) in Bicep deployment

[haileyvictory]

Description:
Our Bicep infrastructure currently provisions Azure Cognitive Services (OpenAI) via infra/app/openai.bicep without a managed identity assigned.
PSRule for Azure baseline Azure.AI.ManagedIdentity requires that managed identities are enabled for AI resources when possible.
App Service and Azure Functions are already assigned managed identities, but OpenAI is not.

Acceptance Criteria:

• Add identity: { type: 'SystemAssigned' } to the account resource in infra/app/openai.bicep.
• Template remains deployable and backward compatible.
• No additional secrets are exposed or output.
• (Optional) Output the managed identity principal ID for downstream access control.

References:

• PSRule for Azure: Azure.AI.ManagedIdentity

READY TO BE ASSIGNED TO COPILOT