Add Azure RBAC PIM approval tools

[Copilot]

Approvers need a faster way to discover and approve pending Azure RBAC PIM activation requests without relying on Azure Portal handoffs. This adds MCP coverage for listing approvals assigned to the current approver and approving a selected request stage.

• Commands

  • Added role approval list for pending PIM role assignment approvals at a scope.
  • Added role approval approve with required approval, stage, and justification inputs.

• Authorization service

  • Added ARM REST support for Microsoft.Authorization/roleAssignmentApprovals.
  • Resolves subscription tenant context before calling approval APIs.
  • Maps approval and stage responses into AOT-safe response models.

• Docs and coverage

  • Registered the new command group in Authorization setup.
  • Added unit tests for list/approve success and error paths.
  • Updated command docs, E2E prompts, and changelog entry.

Example usage:

azmcp role approval list \
  --subscription <subscription> \
  --scope <scope>

azmcp role approval approve \
  --subscription <subscription> \
  --scope <scope> \
  --approval <approval> \
  --stage <stage> \
  --justification "Approved for incident response"