feat(activate): add support for activation at a narrower scope

[abicky]

Description

This PR adds support for activating a role at a scope that is narrower than the eligible role assignment scope.

For example, if a user has an eligible role assignment at the subscription scope, they can activate the role for a specific resource or resource group within that subscription.

The Azure portal supports the same behavior for directly contained in a resource group (for example, a Storage Account or Key Vault), although it does not support narrower child-resource scopes such as blob containers.

Type of change

Please delete options that are not relevant.

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

Checklist:

• I have read the contribution guidelines
• My changes follow the Styleguide of this project
• I have run the pre-commit hooks included in this repository
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• All GitHub Actions workflows for this branch/PR have run successfully

[netr0m]

Thanks for your contribution, @abicky! Approved - will include as part of the next release.