Update Documentation to Show how to assign Data Plane RBAC roles

[PlagueHO]

Issue

The Cosmos DB docs aren't very clear that only Data Plane RBAC roles provide Data Plane access (e.g., Cosmos DB Contributor role doesn't provide data plane access).

Update the documentation to make it clear that data plane roles must be assigned via Bicep/ARM/Az CLI/PowerShell etc to Account/Container/Database otherwise Entra ID token gen will fail with unsupported audience.

This is related to #486