Adds Authentication=ActiveDirectoryMSI to the auth pipeline:

- Zero-arg ManagedIdentityCredential() for system-assigned MSI.
- ManagedIdentityCredential(client_id=UID) for user-assigned MSI,
  matching ODBC's convention where UID carries the identity's
  client_id under MSI.
- Threads optional credential_kwargs through get_auth_token /
  get_raw_token / _acquire_token so future auth methods that need
  constructor args (e.g. ClientSecretCredential) can plug in via
  the same channel.
- Cache key remains a plain string for zero-arg auth types and
  becomes a tuple when kwargs are present, so different client_ids
  get separate cached credentials.

Partial fix for #534. ServicePrincipal and
Password to follow as separate PRs.

Connection.__init__ overwrites self.connection_str with the sanitized
(UID-stripped) string returned by process_connection_string. The original
implementation re-parsed self.connection_str at bulkcopy time via
extract_credential_kwargs, which silently dropped the user-assigned MSI
client_id and degraded to system-assigned  a wrong-identity bug.MSI

Changes:

- process_connection_string now returns a 4-tuple including the captured
  credential_kwargs so callers can persist them.
- Connection.__init__ stores _credential_kwargs alongside _auth_type.
- cursor.bulkcopy() reads self.connection._credential_kwargs instead of
  re-parsing self.connection_str.
- The public extract_credential_kwargs helper is removed (it only existed
  to support the broken re-parse path; nothing else needs it).
- black --line-length=100 reformats (CI was red).

Tests:

- test_bulkcopy_path_preserves_user_assigned_msi_client_id: invokes
  cursor.bulkcopy() with a mocked mssql_py_core, patches
  AADAuth.get_raw_token to capture the args it receives, and asserts
  the captured credential_kwargs match Connection._credential_kwargs.
  Fails if cursor reverts to re-parsing self.connection.connection_str.
- test_credential_kwargs_persisted_for_user_assigned_msi: asserts
  Connection.__init__ stores _credential_kwargs from the 4-tuple.
- test_credential_kwargs_none_for_system_assigned_msi.
- test_credential_kwargs_none_for_non_msi_auth.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Per @saurabh500's review: braced ODBC values like UID={hello=world} need
the canonical parser, not naive partition('='). Without this, the helper
returns '{hello=world}' verbatim and ManagedIdentityCredential rejects it.
Worse, a UID containing a literal ';' would be truncated.

_extract_msi_client_id now delegates to _ConnectionStringParser, which
handles braces, escaped '}}' inside braces, and '=' inside braced values
correctly. validate_keywords=False so the helper never raises on keys
the auth flow doesn't care about.

Tests:
- test_msi_braced_uid_value_is_unwrapped: UID={hello=world} -> 'hello=world'
- test_msi_braced_uid_with_semicolon_is_preserved: UID={abc;def;ghi}

Note: process_connection_string and extract_auth_type still use naive
split(';') for Authentication= detection across all Entra ID auth types.
That's pre-existing and tracked separately for a parser-wide refactor.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Debug log distinguishing user-assigned vs system-assigned MSI when the
  user passes Authentication=ActiveDirectoryMSI. Helps diagnose which
  branch was taken when token acquisition fails. Logs client_id length,
  not value (still identity material).
- Comment above _credential_cache explains the cache key shape so the
  unbounded growth is understood as a deliberate choice rather than an
  oversight.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Connection.__init__ already parses the same connection string through
_ConnectionStringParser via _construct_connection_string (connection.py
line 253) before process_connection_string is ever called. By the time
_extract_msi_client_id runs, the input is guaranteed parseable.

The try/except was dead code. A real parse failure here would indicate
an upstream bug and should propagate, not silently degrade user-assigned
MSI to system-assigned (which is the wrong-identity failure mode this PR
exists to prevent).

Brings diff coverage to 100%.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Tracking refactor (parse-once, thread the parsed map through the auth
path) is a separate follow-up; this docstring helps anyone reaching
into the function before that lands.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>