Minimal Permissions for user credentials

[rfranzke]

From gardener-attic/gardener-extensions#133

We have narrowed down the access permissions for AWS shoot clusters (potential remainder tracked in #178), but not yet for Azure, GCP and OpenStack, which this ticket is now about. We expect less success on these infrastructures as AWSes permision/policy options are very detailed. This may break the "shared account" idea on these infrastructures (Azure and GCP - OpenStack can be mitigated by programmatically creating tenants on the fly).

[rfranzke]

Disclaimer: It is unclear whether the current required permissions can be narrowed down even more (whether the cloud provider allows this fine-granular tuning) - if you think it is not possible/not recommended please close the issue with a proper explanation.

[dansible]

Follow up from #44 - we're currently using the Contributor role for the Azure ServicePrincipal but it's likely that this is overprivileged. Is there a better role to use or a custom set of permissions to grant to the SP?

[muenchdo]

I'm also very interested in this as we are currently discussing deploying a shoot into a customer's Azure subscription.