Bump AIO component versions and fix schema-registry RBAC + K3s bootstrap

[bindsi]

Summary

Several issues block clean Azure IoT Operations deployments on the current main:

1. Schema upload fails with HTTP 403 AuthorizationPermissionMismatch. The deploying principal lacks Storage Blob Data Contributor on the schema-registry container. It currently only works transitively when the 030-data data-lake module is also deployed (which grants Storage Blob Data Owner at the storage account scope) — the schema-registry module is not self-contained.

2. K3s VM Arc bootstrap (linux-cluster-server-setup) fails on azure-cli 2.67+. The --client-id flag for az login --identity was removed in 2.67. Both deploy-script-secrets.sh and k3s-device-setup.sh still use the old syntax.

3. Pinned AIO component versions are out of date relative to az iot ops 2.4.0:

   • cert-manager 0.10.2 → 0.11.0
   • secret-sync-controller 1.3.0 → 1.4.0
   • iotoperations 1.3.38 → 1.3.70

4. Blueprint Bicep parameters were temporarily downgraded to vars while DeploymentScripts was pinned to az CLI < 2.71. trustIssuerSettings, shouldDeployAioDeploymentScripts, shouldEnableOtelCollector, and shouldEnableOpcUaSimulator should be first-class params again now that the runtime supports az CLI 2.71+.

5. Missing OPC UA securityPki.applicationUri. The AIO instance config does not set a per-cluster OPC UA broker application URI, so deployments can collide on the default URN.

6. No upgrade documentation. Users have no guide for moving an existing AIO deployment to newer component versions (az iot ops upgrade + Terraform -refresh-only reconciliation).

Acceptance criteria

• Schema-registry Terraform module grants Storage Blob Data Contributor on the schemas container, scoped narrowly, with an optional override for non-interactive principals.
• K3s bootstrap scripts work on azure-cli 2.67+.
• cert-manager, secret-sync-controller, and iotoperations defaults updated in both Bicep and Terraform.
• Blueprint full-single-node-cluster Bicep restores the four parameters with sensible defaults.
• AIO instance config sets a deterministic per-cluster securityPki.applicationUri in both Bicep and Terraform.
• Getting-started docs include an AIO upgrade guide and cross-link from the general user guide.

Notes

Addressed in #471.