Support for storing the encryption keys of non-core resources (such as workspaces) in an external Key Vault

[yuvalyaron]

Once #4145 and #4143 are completed, we will need to enable workspace resources to access the external Key Vault for accessing the CMK.
However, since the external Key Vault is outside of TRE's network, this might not be feasible.

• make sure to update the CMK section in the docs accordingly.