Reduce default KeyVault role

[eerhardt]

Description

KeyVaultAdministrator is too high of a priviledge role to use by default in applications. By default apps should not need to manage key vault settings, but instead just be able to read secrets. So instead, by default apps will get KeyVaultSecretsUser role and if an application needs a higher role, it can be configured easily by using WithRoleAssignments.

Fix #8218

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
• Did you add public API?
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
• Does the change require an update in our Aspire docs?
  • Yes
    • Is this introducing a breaking change?
      • Yes
        • Link to aspire-docs issue [Breaking change]: KeyVault default role assignment changing from KeyVaultAdministrator to KeyVaultSecretsUser docs-aspire#2899

[Copilot]

Pull Request Overview

This PR aims to lower the default KeyVault role for applications from KeyVaultAdministrator to KeyVaultSecretsUser to reduce privilege levels.

• Updated test resource definitions in AzureBicepResourceTests.cs to assign the KeyVaultSecretsUser role.
• Modified default role assignment in AzureKeyVaultResourceExtensions.cs to use KeyVaultSecretsUser by default.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
tests/Aspire.Hosting.Azure.Tests/AzureBicepResourceTests.cs	Changed role assignments from KeyVaultAdministrator to KeyVaultSecretsUser to match reduced privilege requirements
src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultResourceExtensions.cs	Updated default role in the role assignment method to use KeyVaultSecretsUser