feat(provider): add Azure App Configuration

[itpropro]

Summary

• add Azure App Configuration provider support for direct values, guarded writes/deletes, declaration discovery, exact labels, prefixes, tags, sovereign endpoints, and SecretSpec provider credentials
• resolve canonical Azure Key Vault references with latest or pinned versions, deduplicated batch reads, and one or multiple authorized vaults
• support Entra ID and connection-string authentication while keeping App Configuration and Key Vault identities independent
• document 0.19+ configuration, deployment topologies, caching boundaries, security limits, and Entra-first authentication guidance

Scenario coverage

• direct App Configuration values with null and exact labels, prefix/tag filters, and escaped filter characters
• latest, pinned, duplicate, single-vault, and multi-vault Key Vault references
• Entra and HMAC reads, filtered discovery, read-write CRUD, and read-only HMAC 403 enforcement
• conditional writes/deletes, pagination, Sync-Token propagation, malformed responses, selector refusal, and bounded multi-vault behavior through protocol tests

Validation

• cargo test --all
• focused Azure App Configuration, Azure Key Vault, and generic provider suites
• devenv shell -- prek run -a
• npm --prefix docs run build (74 pages)
• authenticated Azure validation against App Configuration and two Key Vaults; all fixtures removed and local authentication restored to disabled
• independent clean-context GPT-5.6 Sol xhigh review: no actionable findings

Live denied-vault batch failure, service pagination, concurrent ETag races, and observed Sync-Token variants remain protocol-tested rather than service-observed.

[itpropro]

@domenkozar would like to hear your thoughts on this, anything that needs improvement?

[domenkozar]

Needs a rebase, hoping for someone that uses Azure to give it a spin :)

[itpropro]

Needs a rebase, hoping for someone that uses Azure to give it a spin :)

I'll do the rebase. It is already tested against Azure, I implemented it because I am using Azure ;)
Tested it against a live environment with multiple read only identities and app config only, app config + key vault and app config + multiple key vault references with different identities for both.

[itpropro]

Rebased @domenkozar

[itpropro]

@domenkozar anything else I can do/fix?

[domenkozar]

I'll take a look soon, could you rebase please?