Add DeleteAfter tag and resource cleanup for test resource service principals

[benbp]

We create a lot of new service principals in the development workflow for the New-TestResources.ps1 script. Right now we don't have any great ways of cleaning these up. We should follow the same model we do for resource groups, where we add a time-based DeleteAfter tag, and query for those resources in the live test resource cleanup pipeline.

[weshaggard]

If we can do that great but I've found that there is a lack of permissions to delete the service principal in the normal case only the creator has permissions.

[jsquire]

Maybe we could emit a tag for the resource group that identifies the Test Application principal associated with it and integrate that with Remove-TestResources; that may not solve the permissions issue that Wes is highlighting, but it may help with the clutter for manual clean-up cases.

[benbp]

@weshaggard is the issue you're referring to that we couldn't add a group as an SP owner (issue)? I think we could update the script or perhaps policy to add our provisioner identity as an owner.

[kurtzeborn]

Triaging old issues... we definitely will still need this as we accumulate service principals and hit a hard cap at some point.