Add MSP install mode

[jflieben]

for easier multi tenant scanning

notes:

• MI would not work, would need byo cert or federated credentials but maester doesn't really know how to impersonate
• Subscription login separate from root rbac role assignment