Add Entra credential fallback to CreateAzdoClient (Phase 1, WI 10141)

[missymessa]

Summary

Phase 1 of migrating the dn-bot-all-orgs-build-rw-code-rw PAT from Basic auth to Entra-based authentication in the V3 publishing pipeline.

This PR contains only backward-compatible C# changes. YAML and secret manifest changes will follow in Phase 2 after this SDK version flows to consumers.

Why Phase 1/Phase 2?

The original PR #16785 was reverted (#16792) because it combined C# code changes (shipped in the Arcade SDK NuGet package) with YAML changes (take effect immediately on merge). After merge, the Maestro Build Promotion pipeline was still running the old SDK version (which required AzdoApiToken), but the YAML had already stopped passing it, causing:

error : The property AzdoApiToken is required when using streaming publishing, but doesn't have a value set.

Build: https://dev.azure.com/dnceng/internal/_build/results?buildId=2972977

Changes (C# only, PublishArtifactsInManifestBase.cs)

• CreateAzdoClient(): When no PAT is provided, falls back to DefaultIdentityTokenCredential with bearer token for AzDO resource (499b84ac-1321-427f-aa17-267ca6975798/.default). Supports AzurePipelinesCredential (from AzureCLI@2 with addSpnToEnvironment:true), ManagedIdentityCredential, WorkloadIdentityCredential, and AzureCliCredential.
• HasEntraCredentialsAvailable(): New method to check for available Entra credentials, used in validation to avoid false errors when streaming publishing is configured without a PAT.
• AnyMissingRequiredBaseProperties(): Relaxed validation -- only errors on missing AzdoApiToken when Entra credentials are also unavailable.

What is NOT in this PR (Phase 2)

After this SDK version builds and flows to consumers:

1. Remove /p:AzdoApiToken='$(dn-bot-all-orgs-build-rw-code-rw)' from publish.yml
2. Remove PAT from binlog redaction list in publish-logs.yml
3. Delete PAT entry from secret manifest (product-builds-engkeyvault.yaml)

Identity details

• MI: maestro-build-promotion-mi (AppId: 6e870007-e236-4eb1-8734-8bf8cd54c748)
• SC: maestro-build-promotion (ID: df3b9892-c5c9-4d64-8b72-edd72e049305, type: azurerm, auth: WorkloadIdentityFederation)
• Enrollment: Confirmed in dnceng/internal Readers group

Work Item: https://dev.azure.com/dnceng/internal/_workitems/edit/10141