Configure an AKS cluster's service principal with permissions to access your Azure container registry in a different AD tenant