ci: migrate ACR login to OIDC/UAMI managed identity

[BenjaminMichaelis]

• Replace docker/login-action (admin credentials) with az acr login via OIDC session (azure/login with AZURE_CLIENT_ID)
• Add --registry-identity and --user-assigned flags to az containerapp up so identity attachment and registry config happen atomically on create and update, eliminating the chicken-and-egg ordering issue
• Replace az config set extension.use_dynamic_install with explicit az extension add --name containerapp --upgrade to ensure the extension version supports --registry-identity on az containerapp up
• Remove --registry-username/--registry-password from containerapp up
• Update Assign MI step to use WEB_UAMI_RESOURCE_ID and WEB_UAMI_CLIENT_ID

Description

Describe your changes here.

Fixes #Issue_Number (if available)

Ensure that your pull request has followed all the steps below:

• Code compilation
• Created tests which fail without the change (if possible)
• All tests passing
• Extended the README / documentation, if necessary

[Copilot]

Pull request overview

This PR updates the GitHub Actions deployment workflow to authenticate to Azure Container Registry (ACR) and Azure Container Apps using OIDC + user-assigned managed identity (UAMI), removing reliance on ACR admin credentials and making identity/registry attachment occur as part of the az containerapp up operation.

Changes:

• Replace docker/login-action (ACR username/password) with az acr login after azure/login OIDC auth.
• Update az containerapp up to use --registry-identity and --user-assigned, removing --registry-username/--registry-password.
• Replace dynamic extension install config with explicit az extension add --name containerapp --upgrade.