feat(authbridge): add Microsoft Entra ID token-exchange plugin

[huang195]

Summary

Implement an IdP plugin for Microsoft Entra ID token exchange, conforming to the IdP-agnostic interface defined in #481.

Scope

• New plugin package under authbridge/authlib/plugins/ registered via RegisterPlugin.
• Entra token endpoint / OIDC discovery (v2.0 endpoints, tenant-aware).
• Map RFC 8693 exchange onto Entra's supported flow (e.g. OBO / urn:ietf:params:oauth:grant-type:jwt-bearer), with scope/audience encoding per Entra conventions.
• Config schema (SchemaProvider) for tenant ID, client credentials, scopes.
• Unit tests using the plugintesting harness; doc page under authbridge/docs/.

Blocked by

#481 (Phase 1 interface).

[huang195]

cc: @sabre1041

[akram]

The primary use case for Entra ID integration with AuthBridge is the RFC 7523 federated token exchange flow: Keycloak JWT used as client_assertion to obtain an Entra access token. Tracked in #525. The Entra provider implementation should support both direct (Entra-native agent) and federated (Keycloak agent → Entra token) credential modes.

[huang195]

closing it for now as this is not our priority at the moment