Fix Azure PIM catch-22: discover eligible roles without standing subscription access

[Copilot]

Users with zero standing Azure access hit a dead end: Get-AzSubscription requires subscription read rights, but subscription access requires activating a PIM role, which requires discovering eligible roles first.

Changes

• Get-AzureResourceRoles.ps1
  • Changed Get-AzSubscription -ErrorAction Stop → @(Get-AzSubscription -ErrorAction SilentlyContinue) — eliminates the throw when the account has no subscription visibility
  • Added ARM REST API fallback when no subscriptions are returned: calls Invoke-AzRestMethod at tenant scope to enumerate eligible role assignments — this endpoint requires only an authenticated context, not subscription read access
  • GUID-validates UserObjectId before embedding in the OData filter string

# Tenant-level query — works with zero standing subscription access
Invoke-AzRestMethod -Method GET `
    -Path "/providers/Microsoft.Authorization/roleEligibilitySchedules?api-version=2020-10-01&`$filter=principalId eq '$UserObjectId'"

The fallback returns the same role object shape as the normal subscription-enumeration path, so downstream consumers are unaffected.