Change Azure OpenAI to use CognitiveServicesOpenAIUser role by default

[eerhardt]

Description

The CognitiveServicesOpenAIContributor role is too permissive as it allows an app to modify deployments (i.e. models). Instead we should be defaulting to CognitiveServicesOpenAIUser which allows the app to do inference, but not modify the resources.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
• Did you add public API?
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • No
• Does the change require an update in our Aspire docs?
  • Yes
    • Link to aspire-docs issue (consider using one of the following templates):
    • [Breaking change]: AddAzureOpenAI defaults to CognitiveServicesOpenAIUser instead of CognitiveServicesOpenAIContributor docs-aspire#3936

[Copilot]

Pull Request Overview

Updates the default Azure OpenAI role assignment from Contributor to User, limiting permissions to inference only.

• Change default built-in role in AddAzureOpenAI extension from Contributor to User
• Update unit tests to expect the User role GUID
• Modify sample Bicep module to assign the User role

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tests/Aspire.Hosting.Azure.Tests/AzureOpenAIExtensionsTests.cs	Updated role resource and GUID in tests to use User instead of Contributor
src/Aspire.Hosting.Azure.CognitiveServices/AzureOpenAIExtensions.cs	Swapped default role assignment parameter to User
playground/OpenAIEndToEnd/OpenAIEndToEnd.AppHost/openai-roles.module.bicep	Changed Bicep role assignment resource to use User role