Pipelines access key vault and storage through private endpoints

[damonbarry]

As part of SFI work, we have to ensure that Azure resources used by our tests--specifically key vaults and storage accounts--are not open to the public internet. To complete the SFI work, we needed to make some updates to our test infrastructure. Specifically, this change ensures we only access key vaults from Azure Virtual Networks (vnets) so that we can use Private Link and private endpoints. This required that we move key vault access out of jobs that run from on-prem agents (e.g., Raspberry Pis used to test arm32v7 support). Note that we already take this approach when it comes to accessing storage accounts.

There was also a bit of refactoring involved so that we could optionally do the key vault access from a standalone job that always runs in Azure. In the pipelines that require it, we leveraged an existing job that generates a SAS token for accessing the test storage account.

To test, I ran the affected pipelines to ensure they pass:
CI build
CI test
Connectivity tests
End-to-end tests
Nested end-to-end tests
ISA-95 smoke tests

Azure IoT Edge PR checklist:

This checklist is used to make sure that common guidelines for a pull request are followed.

General Guidelines and Best Practices

• I have read the contribution guidelines.
• Title of the pull request is clear and informative.
• Description of the pull request includes a concise summary of the enhancement or bug fix.

Testing Guidelines

• Pull request includes test coverage for the included changes.
• Description of the pull request includes
  • concise summary of tests added/modified
  • local testing done.