Advisory check that the subscription's service principal can create AVD control-plane
resources: host pool, application group, and workspace update. Covers the control-plane
portion of the Create Host Pool wizard (POST host-pool-deployments); when initial session
hosts will also be created, additionally call the session host create pre-flight.

Each required permission is evaluated at exactly the scope the create flow exercises it
against (inherited grants from resource group, subscription, or management group count).

Always returns 200 for a valid request and subscription and never blocks creation:

• granted: all required actions confirmed at their target scopes.
• missingPermissions: at least one action could not be confirmed; display the returned message as a warning.
• unknown: the check itself could not run (transient error); do not show a warning.