feat: update alz custom roles

[jtracey93]

Updating ALZ custom role defs created

This pull request updates the Azure Landing Zones role definitions and assignments across Terraform, Bicep, GitHub, and local environments to standardize naming, expand permissions, and clarify role descriptions. The changes mainly address naming consistency, broaden the scope of custom roles, and refine permissions for management group operations.

Role Naming Standardization:

• Renamed all instances of alz_managment_group_contributor and alz_managment_group_reader to alz_management_group_contributor and alz_management_group_reader for consistency in variables.tf files across all environments. [1] [2] [3] [4] [5] [6] [7] [8] [9]

Role Definition and Permission Updates:

• Expanded the actions for Bicep contributor and reader roles to use wildcard permissions (e.g., "*/read", "Microsoft.Management/*", etc.), and added explicit exclusions to restrict resource group modifications. [1] [2]
• Removed several granular deployment and stack-related permissions from Terraform contributor and reader roles to streamline access. [1] [2] [3]

Role Description Improvements:

• Updated descriptions for Bicep roles to clarify their expanded scope, including managing the management group hierarchy and governance resources, and added instructions for using the providerNoRbac validation flag with Bicep What If operations. [1] [2] [3] [4]

Role Assignment Key Updates:

• Updated role assignment keys in Terraform and Bicep sections to match the new standardized role names, ensuring correct mapping for plan and apply operations. [1] [2] [3] [4]

Permission Refinements for Subscription Reader Role:

• Adjusted the subscription reader role to align with the new management group hierarchy scope and added instructions for Bicep What If usage. Also, replaced granular write permissions with broader read and validation actions. [1] [2]

[jaredfholgate]

LGTM