Updates for network isolation and account key removal

[TomAugspurger]

Updates to the deployment and runtime to

1. Work with storage accounts where account key access is disabled
2. Comply with stricter network isolation requirements

[TomAugspurger]

I plan to merge this once CI passes.

[TomAugspurger]

Test failures hopefully fixed (azurite doesn't support token credentials, so we need to use the account key in from_account_key, rather than generating a SAS token)

[TomAugspurger]

New failure at https://github.com/microsoft/planetary-computer-tasks/actions/runs/9863208116/job/27235465737?pr=309#step:6:78.

=================================== FAILURES ===================================
__________________________ test_walk_match_full_path ___________________________

    def test_walk_match_full_path():
        storage = LocalStorage(HERE / ".." / "data-files" / "simple-assets")
        subdirs = {
            root: files
            for root, _, files in storage.walk(
                min_depth=1, max_depth=1, matches="a/asset-.*.json", match_full_path=True
            )
        }
>       assert subdirs["a"] == ["asset-a-1.json", "asset-a-2.json"]
E       AssertionError: assert ['asset-a-2.j...set-a-1.json'] == ['asset-a-1.j...set-a-2.json']
E         At index 0 diff: 'asset-a-2.json' != 'asset-a-1.json'
E         Use -v to get the full diff

I couldn't reproduce it. Updated the test to ignore the order...

[TomAugspurger]

I don't know why the integration tests are failing (presumably auth?) but AFAICT there's nothing in the logs indicating what the issue is.

I haven't been able to run the integration tests locally. I'm inclined to just skip them at this point :/

[TomAugspurger]

I think we'll need to revert some of the changes to the Helm chart removing the account key from the pctasks-server Deployment. IIUC these integration tests are using Azurite, which requires the account key. I'll try that quick.

[TomAugspurger]

Wohoo, finally passing.