RELOPS-2209: replace puppet kitchen identity with ronin OIDC

[jwmossmoz]

Summary

• replace legacy sp_puppet_test_kitchen.tf resources with a fresh kitchen-ronin-puppet.tf identity
• create ronin-puppet-test-kitchen app registration and service principal owned by Relops group members
• add GitHub Actions OIDC federated credentials for pull_request and refs/heads/*
• grant subscription-level Contributor role assignment to the new service principal
• migrate terraform/azure_ad provider constraint to hashicorp/azuread ~> 3
• update AzureAD v3-incompatible ID usage (id -> object_id where UUIDs are required)
• ignore and untrack terraform/azure_ad/.terraform.lock.hcl
• related workflow PR: [RELOPS-2111] Add Windows 11 25H2 Test Kitchen integration testing ronin_puppet#1055

Validation

• terraform fmt on changed files
• unable to run full init/plan in this environment due expired AWS credentials (ExpiredToken from STS)