Pulumi: replace domain controller with AzureAD proxy

[jemrobinson]

✅ Checklist

• I have searched open and closed issues for duplicates.
• This is a request for a new feature in the Data Safe Haven or an upgrade to an existing feature.
• The feature is still missing in the latest version.
• I have read through the documentation.
• This isn't an open-ended question (open a discussion if it is).

🍓 Suggested change

We should write a proxy server that can accept LDAP requests and query AzureAD for the answers. Ideally this should be available as a Docker image.

🚂 How could this be done?

The Python ldaptor package might be a good place to start.
I've got a proof-of-concept working here which I've called Apricot.

• Add required AzureAD/GraphAPI functionality to the code (see Add AzureAD/EntraID functionality #1778)
• Update SRE components to use Apricot for authentication/identity (see Use Apricot for authentication/identity #1772)
• Remove the SHM domain controller (see Remove SHM DC #1805)