How can one use an Entra ID account and Azure’s Access Control (AIM) to access Azure resources, in particular, Azure Blob Storage, directly from the browser, without sharing any secrets (which would be insecure).