Demo custom managed key encryption at rest (service side) in our bicep provisioning scripts

[jfomhover]

Following https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview

TODO:

• implement a keyvault for each orch/silo hosting an RSA key
• set an identify for the storage to access this keyvault
• set encryption service-side with custom keys from said keyvault

Bicep: https://learn.microsoft.com/en-us/azure/templates/microsoft.storage/storageaccounts?pivots=deployment-language-bicep

Example bicep: https://github.com/Azure/azure-quickstart-templates/blob/master/quickstarts/microsoft.storage/storage-blob-encryption-with-cmk/main.bicep