Creates a single long-running tenant import job under the shared tenant inventory lock.
The job discovers the requested subscriptions and resources, follows linked resource owners across
subscriptions, and saves the collected resources according to the import mode.
Track the job's progress and result via the Jobs API.

Two modes are supported:

1. Import All: Set importAll: true to discover all subscriptions and import all resources
2. Selective Import: Provide specific subscriptions and optional resource IDs to import.
   Empty or omitted resources is valid for both Reconcile and Additive.
   Under Reconcile, that empty list is the desired snapshot and existing managed resources on those
   subscriptions are soft-deleted. Under Additive, the subscription is registered or kept and existing
   managed resources are preserved.

Selective imports default to Reconcile: subscriptions omitted from the request are soft-deleted.
Set importMode to Additive to preserve subscriptions and resources omitted from the request.

When importing, CloudSubscription records are automatically created for Azure subscriptions
that don't exist yet in the system. These subscriptions are linked to the tenant and use
the tenant's default credentials.