Multi-subscription and multi-tenant deployment support

[arnaudlh]

Description

Enterprise deployments often span multiple subscriptions (hub-spoke, landing zones) and sometimes multiple tenants. Git-ape currently targets a single subscription per deployment.

Related: #14 (Landing Zone detection)

Scope

1. Multi-subscription templates — Support cross-subscription resource group deployments.
2. Hub-spoke networking — Templates that deploy hub resources in one subscription and spoke resources in another.
3. Multi-tenant OIDC — Onboarding support for federated credentials across tenants.
4. Subscription selector — During requirements gathering, let users specify target subscriptions for different resource groups.

Acceptance Criteria

• Deployment supports resources across 2+ subscriptions.
• Onboarding configures OIDC for multiple subscriptions.
• Hub-spoke networking pattern is supported.