RBAC permission on the key vault - TF for now, bicep in the future

[blgorman]

Need to add documentation around setting up the owner permission on the new resource group for the managed identity. The key vault RBAC fails in deployment if the MI doesn't have the ability to assign permissions on the key vault