Least-privilege Azure RBAC for read-only architecture review

A custom role with */read plus two actions, scoped to one resource group: everything a read-only scanner needs, and nothing it doesn't.