Add AzureApplicationCredential

[chlowell]

It's the first two links of DefaultAzureCredential, namely EnvironmentCredential and ManagedIdentityCredential, so a better default for an application deployed to Azure that doesn't want to authenticate as a user or through dev tools.

Closes #18020, closes #19309

[check-enforcer]

This pull request is protected by Check Enforcer.

What is Check Enforcer?

Check Enforcer helps ensure all pull requests are covered by at least one check-run (typically an Azure Pipeline). When all check-runs associated with this pull request pass then Check Enforcer itself will pass.

Why am I getting this message?

You are getting this message because Check Enforcer did not detect any check-runs being associated with this pull request within five minutes. This may indicate that your pull request is not covered by any pipelines and so Check Enforcer is correctly blocking the pull request being merged.

What should I do now?

If the check-enforcer check-run is not passing and all other check-runs associated with this PR are passing (excluding license-cla) then you could try telling Check Enforcer to evaluate your pull request again. You can do this by adding a comment to this pull request as follows:
/check-enforcer evaluate
Typically evaulation only takes a few seconds. If you know that your pull request is not covered by a pipeline and this is expected you can override Check Enforcer using the following command:
/check-enforcer override
Note that using the override command triggers alerts so that follow-up investigations can occur (PRs still need to be approved as normal).

What if I am onboarding a new service?

Often, new services do not have validation pipelines associated with them, in order to bootstrap pipelines for a new service, you can issue the following command as a pull request comment:
/azp run prepare-pipelines
This will run a pipeline that analyzes the source tree and creates the pipelines necessary to build and validate your pull request. Once the pipeline has been created you can trigger the pipeline using the following comment:
/azp run python - [service] - ci

[mccoyp]

Looks good to me -- my only question is about the open question that was posed in the credential proposal doc:

OPEN QUESTION: Should the AzureApplicationCredential allow users to specify service principal credential details through code? This would be different from the DefaultAzureCredential where users can only provide service principal credential information via environment variables. However, since this new credential strictly authenticates applications perhaps also providing a means to configure via code makes sense.

Did everyone agree to stick to the DefaultAzureCredential-style flow for now? I assume that means that AZURE_TENANT_ID, etc. are only provided as environment variables and can't be provided as, say, kwargs

[chlowell]

We haven't discussed it, so no consensus on that question as yet. I started without API for specifying a service principal because I think developers who want to do that should use Certificate- or ClientSecretCredential instead. What do you think?

[mccoyp]

I think I agree. It's better to add that support later if it's desired than get stuck with a feature that's not useful, since I don't see much value in using the AzureApplicationCredential in that scenario. The only useful application I can think of off the top of my head would be if someone wanted to override (a) particular environment variable(s), but that seems like an edge case.