[Role] az ad sp create-for-rbac: Deprecate creating Contributor role assignment by default

[jiasli]

Description
az ad sp create-for-rbac creates a Contributor role assignment at subscription scope if --skip-assignment or --role is not provided. This is a dangerous behavior and contradicts the principle of least privilege.

This PR adds the warning to help message and command execution that:

In a future release, this command will NOT create any role assignment by default. (--skip-assignment will be the default behavior.) If needed, always use --role to explicitly create a role assignment.

Testing Guide

> az ad sp create-for-rbac --help

        By default, this command assigns the 'Contributor' role to the service principal at the
        subscription scope. To reduce your risk of a compromised service principal, use --skip-
        assignment to avoid creating a role assignment, then assign a more specific role and narrow
        the scope to a resource or resource group. See [steps to add a role
        assignment](https://aka.ms/azadsp-more) for more information.

        WARNING: In a future release, this command will NOT create 'Contributor' role assignment by
        default. If needed, always use --role to explicitly create a role assignment.

> az ad sp create-for-rbac
WARNING: In a future release, this command will NOT create 'Contributor' role assignment by default. If needed, 
always use --role to explicitly create a role assignment.
WARNING: Creating 'Contributor' role assignment under scope '/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590'
WARNING:   Retrying role assignment creation: 1/36
{
  "appId": "bc26a0e0-a351-403a-9605-f97424e35dd2",
  "displayName": "azure-cli-2020-11-30-06-01-01",
  "name": "http://azure-cli-2020-11-30-06-01-01",
  "password": "...",
  "tenant": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a"
}

See email:

• az ad sp create-for-rbac: Deprecate creating role assignment by default
• Updating az ad sp create-for-rbac behavior and warning

[jiasli]

Need to detect whether role is explicitly set and show the warning if not.

If role='Contributor' is used, it won't be possible to detect if role is provided by the user or as the default value.

See https://stackoverflow.com/a/14749388

[jiasli]

Another option is to check role.is_default, and show the warning message accordingly. If role is assigned a default value, its type will be knack.validators.DefaultStr which has is_default field indicating whether it is the default value.

[jiasli]

Echo the role name to be more explicit and informative.

[yonzhan]

Role

[evelyn-ys]

Shall we mark --skip-assignment as deprecated this time?

[jiasli]

Shall we mark --skip-assignment as deprecated this time?

No, as it will be become the default behavior, instead of deprecated. We now recommend the user to use it!

Marking it as deprecated will further confuse the user. We can marked it as deprecated AFTER it becomes the default behavior.

[yonzhan]

LGTM