[Identity] Enable brokered auth in DAC

[pvaneck]

Description

This adds InteractiveBrowserBrokerCredential silent flow authentication to the end of the DefaultAzureCredential chain. Here, we opt to conditionally add it to the chain only if the broker package is installed.

Additional context: https://gist.github.com/christothes/f8a0dc6249261cb36a6c452717c4e932

Closes: #39966

[azure-sdk]

API change check

API changes are not detected in this pull request.

[pvaneck]

@xiangyan99 This is the preliminary implementation. Would be good to get your thoughts on:

1. If we should introduce more keyword arguments for broker cred client_id/tenant_id or reuse interactive_browser_client_id and interactive_browser_tenant_id which I am currently doing.
2. Since this is the silent flow and non-interactive, should we introduce this credential to the async DAC (even though it would be run synchronously)?

[Copilot]

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

Files not reviewed (1)

• sdk/identity/azure-identity/dev_requirements.txt: Language not supported

[xiangyan99]

We need to double check the behavior of get_token in the brokered credential.

Does it raise AuthFail or AuthUnavailable?

[pvaneck]

If within DAC, the broker credential token request methods will raise CredentialUnavailableError. However, I am noticing that if silent auth fails, we fall back to interactive sign-in. If we want this to be purely silent auth, we'd likely have to introduce some kwarg to signal the credential not to try interactive auth. WDYT?