[DO NOT MERGE] Add token revocation support for App Service

[gladjohn]

Fixes #5495

App Service Managed Identity Token Revocation Enabled in Public Cloud (Sovereign Clouds ETA 2–3 Weeks)

⚠️🚨 CAUTION – Token Revocation Rollout 🚨⚠️

This PR enables Managed Identity Token Revocation in Azure App Service (public cloud).
👉 Sovereign cloud support is still pending (ETA ~2–3 weeks).

---

Fixes #5495

App Service Managed Identity Token Revocation Enabled in Public Cloud (Sovereign Clouds ETA 2–3 Weeks)

Changes proposed in this request
This change finalizes support for managed identity access token revocation behavior in Azure App Service for public cloud.
A validation was added to the AcquireMSITokenWithClaimsAsync test to ensure a claims challenge triggers issuance of a new access token (token with claims != cached token). This confirms cache bypass semantics required for revocation scenarios.

Important note – Sovereign (Gov/DoD/China) cloud rollout is in progress and expected within 2–3 weeks; no code changes needed for that enablement.

Key points:

• ✅ Public cloud: Revocation-ready (claims challenge forces fresh token).
• 🧪 Test enhancement: Added Assert.AreNotEqual between initial token and claims-challenge token.
• 🌍 Sovereign clouds: Activation pending backend deployment; no further client changes anticipated.

Impact:

• Improves confidence in revocation flows (conditional access / credential compromise responses).
• No breaking changes; existing integrations continue to function.

Next steps (post-merge):

• Monitor sovereign activation window.
• Add release notes entry once sovereign rollout completes (no further code expected).

Testing

• unit
• integration

Performance impact

• none

Documentation

• All relevant documentation is updated.