Adding new keys to the `/etc/apt/trusted.gpg.d` keyring is not
recommended because it will make `apt` accept packages from any
repository signed by this key. This could lead to third-party
repositories "overriding" packages from the official ones.
To prevent that, we create a dedicated keyring for the Microsoft key and
specify that it is only to be used for packages from the `azure-cli`
repository.