Add Azure delegated token authentication provider

[nspringdd]

Summary

Adds Azure support for delegated authentication through a new AzureAuth provider.

Applications can provide a pre-minted Microsoft Entra ID access token or inject a TokenSource that acquires and renews tokens. The client does not invoke the Azure CLI or add an Azure SDK dependency.

Review guide

The change is split into four parts:

1. api/datadog/azure.go defines AzureAuth, token resolution, and proof construction.
2. api/datadog/configuration.go loads DD_AZURE_ACCESS_TOKEN into the default context.
3. .generator/ contains the matching templates so regeneration preserves the feature.
4. tests/api/azure_test.go covers token precedence, failures, and the authentication proof.

Token resolution

AzureAuth resolves an access token in this order:

1. AzureAuth.AccessToken
2. ContextAzureVariables or DD_AZURE_ACCESS_TOKEN
3. AzureAuth.TokenSource

TokenSource has this signature:

type AzureTokenSource func(context.Context) (string, error)

The application owns credential selection, tenant selection, audience or scope, and token renewal. This lets applications adapt Managed Identity, Workload Identity, or an explicitly selected developer credential without making those choices inside the API client.

Authentication flow

After resolving the access token, AzureAuth includes the Datadog organization UUID in the Azure delegated authentication proof and exchanges it for a Datadog delegated token through the existing DelegatedTokenProvider interface.

Usage

Using a pre-minted token from DD_AZURE_ACCESS_TOKEN:

configuration := datadog.NewConfiguration()
configuration.DelegatedTokenConfig = &datadog.DelegatedTokenConfig{
    OrgUUID:      orgUUID,
    ProviderAuth: &datadog.AzureAuth{},
    Provider:     datadog.ProviderAzure,
}

Using application-managed token acquisition:

configuration.DelegatedTokenConfig.ProviderAuth = &datadog.AzureAuth{
    TokenSource: applicationAzureTokenSource,
}

applicationAzureTokenSource is any func(context.Context) (string, error) that returns a current Microsoft Entra ID access token.

Testing

tests/api/azure_test.go covers:

• End-to-end proof construction
• Field, context, environment, and token-source precedence
• Context forwarding to TokenSource
• Wrapped token-source errors
• Empty-token rejection
• Missing-source and missing-organization errors

Verified with:

• go test ./api -run '^TestAzure' from the tests module
• go test ./api/datadog
• go test ./examples/datadog/azure

Related change

PR #4590 adds the corresponding GCP provider. The two PRs may have small mechanical conflicts in shared generator and configuration maps if merged out of order.