Allow Azure Blob Storage Authentication via Workload Identity

[ryanseipp]

Related to #630.

We can set extra configuration via TempoStack's spec.extraConfig.tempo. However, if we define the connection to azure blob storage this way, so that we can set use_federated_token as per the documentation, the operator complains that spec.storage is not valid.

Alternatively, trying to set use_federated_token via the secret is also invalid, as the operator checks for the existence of the account_key key in the secret.