Use Group.Create instead of Group.ReadWrite.All for group creation

[marrobi]

AzureTRE currently grants Group.ReadWrite.All to its Application Admin just so it can create groups. Since November 2023, Microsoft Graph supports Group.Create, which is much more restrictive and matches the actual needs. Please update scripts and docs so only Group.Create is used unless broader group management is actually required.

Group.Create Graph permission docs