Use a dedicated service account for CAPZ controller

[cPu1]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

TODOs:

• squashed commits
• includes documentation
• adds unit tests
• cherry-pick candidate

Release note:

[bulwark-spectrocloud]

⚠️ GoSec scan found code issues:

1. G115: integer overflow conversion int64 -> int32, Severity: HIGH
   • 1. File: /home/runner/work/bulwark/bulwark/target-repo/azure/scope/machinepool.go:984:22
   • 2. File: /home/runner/work/bulwark/bulwark/target-repo/controllers/azuremanagedmachinepool_reconciler.go:168:36
   • 3. File: /home/runner/work/bulwark/bulwark/target-repo/controllers/azureasomanagedmachinepool_controller.go:283:47
   • 4. File: /home/runner/work/bulwark/bulwark/target-repo/controllers/agentpooladopt_controller.go:111:26
   • 5. File: /home/runner/work/bulwark/bulwark/target-repo/azure/scope/managedmachinepool.go:338:29
   • 6. File: /home/runner/work/bulwark/bulwark/target-repo/api/v1beta1/azuremachine_default.go:65:17
2. G404: Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand), Severity: HIGH
   • 1. File: /home/runner/work/bulwark/bulwark/target-repo/azure/scope/strategies/machinepool_deployments/machinepool_deployment_strategy.go:321:7

Please review these findings and fix the issues before merging.