Add explicit Azure CLI authentication

[parthban-db]

🥞 Stacked PR

Use this link to review incremental changes.

• stack/azure-cli-auth [Files changed]

---

Summary

Adds Node.js Azure CLI credentials for Azure Databricks, available only through explicit client configuration.

Why

The VS Code extension supports Azure CLI authentication in the existing SDK and needs equivalent support to complete migration to the modular SDK. The agreed scope is an explicit credential provider, without adding Azure CLI authentication to the default credential chain.

What changed

Interface changes

• Adds newAzureCliCredentials({tenantId?, subscription?, processTimeoutInMs?}), returning TokenCredentials named azure-cli.
• Adds AzureCliCredentialsOptions, AzureCliCredentialsError, and AzureCliCredentialsErrorCode to the Node.js credentials entry point.

Behavioral changes

• Uses an existing az login session to obtain Microsoft Entra tokens for Azure Databricks, with optional tenant, subscription, and CLI timeout selection.
• Returns bearer headers and token expiry, rejects unusable responses, and preserves token-fetch errors as causes.
• The default credential chain and browser credential exports are unchanged.

Internal changes

• Uses Microsoft's @azure/identity rather than implementing subprocess execution and Azure CLI response parsing.
• Adds usage documentation and tests for option forwarding, token renewal, errors, browser exports, and exclusion from the default credential chain.

How is this tested?

npm run ci, npm run format, and auth test type-checking passed locally. All 20 new Azure CLI unit tests pass. A fake-CLI smoke test exercised the real Azure Identity subprocess path for both expiry formats, option forwarding, error handling, and timeouts. Live Azure authentication was not tested.