Allow Azure Arc managed identity requests to forward user-assigned identity selectors (#944)

* Initial plan

* Allow Azure Arc managed identity selectors

* Bump version to 1.38.0rc2

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 593fce2a-8559-422e-92e2-46fb29c251a4

* Fix pipeline container

* Fix pipeline host

* Fix pipeline artifact management

* Fix pipline artifact uploads

* Fix pipeline Linux task

* Refactor the Linux stuff

* Fix pipeline python install

* Fix pipeline python install

* Remove unnecessary Python install

* Update release owners

* Fix Azure Arc resource-id UAMI to forward msi_res_id (not mi_res_id)

Live testing against the Azure Connected Machine agent (1.67, user-assigned preview)
showed the Arc token endpoint only honors the IMDS 'msi_res_id' spelling for the
resource-id selector; 'mi_res_id' is silently ignored and returns the system-assigned
identity, so a resource-id UAMI never resolved. Forward 'msi_res_id' on the Arc request
(matching the VM/IMDS source). Update the unit test accordingly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5ad57850-7d1f-4b9a-bf9f-723d69a9687c

* Revert out-of-scope publish-pipeline changes; keep PR focused on Azure Arc MI

The publish-pipeline edits (BuildDist Linux->Windows pool, python -m build ->
setup.py, dropped twine check, Windows-style artifact paths on Linux pools) are
unrelated to the Azure Arc managed identity selector forwarding this PR targets and
were flagged in review as non-deterministic and broken on Linux. Restore
.Pipelines/pipeline-publish.yml to the dev baseline so those concerns are removed and
the PR only carries the Arc change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5ad57850-7d1f-4b9a-bf9f-723d69a9687c

* Fail closed when Azure Arc does not confirm the requested user-assigned identity

Mirrors the response verification already present in MSAL .NET
(VerifyUserAssignedIdentityWasHonored) and Go (verifyAzureArcUserAssignedIdentity),
addressing review feedback that the Python PR only forwarded the selector without
verifying the token response.

A legacy Azure Arc agent ignores the client_id/object_id/msi_res_id selector and
silently returns the machine's system-assigned identity. After a 200, compare the
echoed identity (client_id/object_id/msi_res_id; mi_res_id accepted as a safety net)
to the requested selector and raise ManagedIdentityError if missing or mismatched, so
MSAL never returns a token for a different identity than the one requested.
System-assigned is unaffected. Existing UAMI forwarding tests now echo the identity;
added a fail-closed test.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5ad57850-7d1f-4b9a-bf9f-723d69a9687c

* Update version from 1.38.0rc2 to 1.38.0

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Nilesh Choudhary <nichoudhary@microsoft.com>
Co-authored-by: avdunn <avdunn@microsoft.com>
Co-authored-by: Gladwin Johnson <90415114+gladjohn@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 593fce2a-8559-422e-92e2-46fb29c251a4
Copilot-Session: 5ad57850-7d1f-4b9a-bf9f-723d69a9687c