Add Microsoft Managed Apps host provider

[alanc-msft]

Summary

Adds a new GCM host provider, Microsoft.ManagedApps, that automatically authenticates against Git repositories hosted by Microsoft Managed Apps' Power Platform environment Git service.

Today, users must hand-author a [credential "https://<host>"] generic OAuth configuration block for every environment subdomain they clone from (each environment gets its own opaque, per-instance hostname). This does not scale, is error-prone, and does not provide single sign-on across environments (the generic OAuth provider keys its refresh-token cache per-hostname).

This PR is a draft shared for early design feedback before further polishing/upstreaming — see "Open items" below.

Design

• Host recognition (ManagedAppsCloudEnvironment): matches hosts against a suffix table per deployment "cloud environment" (prod today; preprod, test, and future sovereign clouds are addable as single compiled-in table entries once their resource/scopes are confirmed). A cloud environment only participates in matching once it has a complete definition (host suffix + resource + scopes), so unconfigured hosts safely fall through to the existing generic OAuth provider with zero regression risk.
• Authentication: reuses the existing, shared MicrosoftAuthentication (MSAL-based) component — the same one Microsoft.AzureRepos uses — instead of the generic OAuth provider's per-host OAuth2 client. Because MSAL's token cache is keyed by client/authority/account rather than hostname, a single interactive sign-in is silently reused across every Managed Apps environment.
• Non-interactive auth: supports managed identity, service principal, and workload identity federation for CI/CD, mirroring Microsoft.AzureRepos.
• Extensibility: new cloud environments are a single-entry addition to a compiled-in table, or addable purely via Git configuration (credential.managedAppsCloudEnvironment.<name>.*) ahead of an official release.
• Registered at Normal priority alongside AzureRepos/Bitbucket/GitHub/GitLab, before the generic catch-all provider.

Testing

• New Microsoft.ManagedApps.Tests project: unit coverage for host matching, config-merge behavior, all four credential-generation paths, and the account-binding manager.
• dotnet build -c WindowsDebug and dotnet test both pass locally (923/923 tests, including the 50 new ones).
• Manually validated end-to-end against the real service: confirmed provider selection, interactive Entra ID sign-in flow, and fallback behavior for not-yet-configured hosts.

Open items

• prod's scopes currently use the broader https://api.powerplatform.com/.default grant rather than the originally intended granular GitRepositories.* permissions, which Microsoft Entra ID rejected with AADSTS65002 (first-party preauthorization required). Reverting once that's granted is a one-line change (see the comment in ManagedAppsCloudEnvironment.CompiledInDefaults).
• preprod/test/sovereign-cloud resource+scopes are not yet defined by the service; those cloud environments are recognized by host suffix only and remain unmatched (safe fallback) until completed.
• Naming/identifiers (Id, Name, namespace) are open to feedback.

Opened as a draft for early feedback — not requesting review/merge yet.