add env vars and update docs

[jaredfholgate]

This PR adds new alternative environment variable to support Azure DevOps Pipelines when using the azurerm backend.

• AZURESUBSCRIPTION_SERVICE_CONNECTION_ID: This is default env var spat out by the Azure DevOps Azure CLI Task and we want to use this by default if not explicitly supplied.
• ARM_ADO_PIPELINE_SERVICE_CONNECTION_ID_BACKEND and ARM_CLIENT_ID_BACKEND: These allow specifying an alternative service connection and client ID that the backend will use. This is to enable using a separate identity for the azurerm backend when using OIDC auth, which has been a long time ask.

There is also an update to the backend docs to specify the least privilege role assignment required following testing.

Fixes: #34322 (comment) - There is a specific ask around using a separate credential for backend.

Target Release

1.12.x

CHANGELOG entry

• This change is user-facing and I added a changelog entry.
• This change is not user-facing.