update ACI deployment prereqs to add requirement for role on the subscription

[willtsai]

Thank you for helping make the Radius documentation better!

Please follow this checklist before submitting:

• Read the contribution guide
• Commands include options for Linux, MacOS, and Windows within codetabs
• New file and folder names are globally unique
• Page references use shortcodes instead of markdown or URL links
• Images use HTML style and have alternative text
• Places where multiple code/command options are given have codetabs

In addition, please fill out the following to help reviewers understand this pull request:

Description

This pull request updates the documentation for configuring Azure provider permissions when deploying Azure Container Instances (ACI) using Radius. The change clarifies the required roles for the Azure provider, making the setup instructions more accurate.

Documentation update for Azure provider permissions:

• Updated the required Azure provider roles to specify that the Reader role is needed on the subscription and the Contributor role is needed on the resource group, instead of requiring both Contributor and Azure Container Instances Contributor roles on both scopes. (docs/content/guides/author-apps/azure/howto-azure-container-instances/index.md)

Issue reference

N/A

[kachawla]

Just curious - why are the subscription level read permissions needed?

[willtsai]

There is an API call in the set of NGroups operations that requires the subscription read permissions. Without those, Radius deployment will report a failure despite the actual deployment being successful:

        {
          "code": "Internal",
          "message": "GET https://management.azure.com/subscriptions/66d1209e-1382-45d3-99bb-650e6bf63fc0/providers/Microsoft.ContainerInstance/locations/WestUS3/nGroupsOperations/08b7511d-65a2-43f0-ab77-2b2cabcd7da2\n--------------------------------------------------------------------------------\nRESPONSE 403: 403 Forbidden\nERROR CODE: AuthorizationFailed\n--------------------------------------------------------------------------------\n{\n  \"error\": {\n    \"code\": \"AuthorizationFailed\",\n    \"message\": \"The client '90b61134-c268-4f0c-bdd1-0a3b42ee915c' with object id 'e5792ec8-3a2b-414c-9797-7f6132ebdcde' does not have authorization to perform action 'Microsoft.ContainerInstance/locations/nGroupsOperations/read' over scope '/subscriptions/66d1209e-1382-45d3-99bb-650e6bf63fc0/providers/Microsoft.ContainerInstance/locations/WestUS3/nGroupsOperations/08b7511d-65a2-43f0-ab77-2b2cabcd7da2' or the scope is invalid. If access was recently granted, please refresh your credentials.\"\n  }\n}\n--------------------------------------------------------------------------------\n"
        }