[Feature Request] Add JWT credential support from Entra

[bgavrilMS]

Is your feature request related to a problem? Please describe.

Federated Identity Credentials can come from:

• an external Identity Provider like Kubernetes or GitHub (Id.Web supports this via SignedAssertionFilePath)
• Entra itself, via MSI (Id.Web supports this via SignedAssertionFromManagedIdentity)
• Entra itself, where the credential is a token from a different tenant or from a different cloud.

Describe the solution you'd like

A new credential named SignedAssertionFromIdentityProvider that supports getting an assertion from Entra.

  "AzureAd": {
      "Instance": "https://login.microsoftonline.com/",
      "TenantId": "T1",
      "ClientId": "c1",
      "ClientCredentials": [
          {
+              "SourceType": "SignedAssertionFromIdentityProvider",
+             "ConfigSectionName": "AzureAdCredentialSource"  // with the help of AcquireTokenOptions.AuthenticationOptionsName 
+              "TokenExchangeUrl": "api://AzureADTokenExchange/"  // audience
          }
      ]
  },
+ "AzureAdCredentialSource" : {    
     "Instance": "https://login.microsoftonline.com/", // could be different cloud
      "TenantId": "T2",
      "ClientId": "c2", 
      "ClientCredentials": [ // the "bottom turtle" needs to have a credential 
          {
              "SourceType": "KeyVault",
              "KeyVaultUrl": "https://webappsapistests.vault.azure.net",
              "KeyVaultCertificateName": "Self-Signed-5-5-22"
          },
       "SendX5C": True
       "AzureRegion": "westus"
}

Note: bottom turtle reference

Multiple credential chaining

The experience above shows 1 hop chaining, but there are scenarios where there could be several hops, i.e. "AzureAd" uses a credential from "AzureAdCredentialSource1" which in turn uses a credential from "AzureAdCredentialSource2", which in turn uses a certificate.

Audience

The audience (TokenExchangeUrl) is mandatory, to prevent app developers from using the api://AzureADTokenExchange/ in other clouds. This url is for the public cloud only.

The SDK shall take care of adding /.default when making the token request.

Implementation Details

Internally, this should reuse the TokenAcquisition classes that use MSAL.