Integrate agentic identity support into the SDK

[rodrigobr-msft]

This pull request introduces significant enhancements and new features for agentic identity and user token management, as well as improvements to connection configuration and selection logic. The changes add support for agentic roles and tokens, extend MSAL authentication flows, and improve robustness in connection management and activity processing.

Agentic identity and token support

• Added new agentic role types (agentic_identity, agentic_user) to RoleTypes, and extended ChannelAccount with agentic_user_id, agentic_app_id, and tenant_id fields for agentic identity tracking. [1] [2]
• Implemented agentic request detection and retrieval methods in Activity (is_agentic_request, get_agentic_instance_id, get_agentic_user) to facilitate agentic context handling.

MSAL authentication and agentic token flows

• Added methods in MsalAuth for acquiring agentic application, instance, and user tokens, including JWT decoding for blueprint ID extraction and error handling for token acquisition failures.
• Improved error handling in get_access_token to log and raise exceptions when token acquisition fails, and fixed method naming (acquire_token_on_behalf_of).

Authorization Handling Overhaul

• Added support for separate processes of authorization handling for each auth handler in the config
• Integrate configured scopes to automatically exchange tokens received from the old user OAuth flows.
• Created a new authorization handler in the form of the AgenticUserAuthorization that acts as intermediary to the agentic token flows mentioned above.

Connection configuration and selection logic

• Updated MsalConnectionManager to handle connection maps as lists, improved initialization, and implemented logic to select the appropriate connection based on audience and service URL, including regex matching and error reporting. [1] [2]
• Improved configuration loading to convert CONNECTIONSMAP to a list of connections for easier processing.

Robustness and cleanup

• Improved handling of claims identity in activity processing to default to an anonymous identity when missing.
• Cleaned up unused imports and removed deprecated OAuth flow exports from __init__.py. [1] [2]

Breaking changes

• Authorization.sign_out(context) calls where no auth handler Id is specified no longer sign out the user from all handlers but instead only from the default handler.

[cleemullins]

Quick initial pass for key stuff to get merged today.

[cleemullins]

Review done in person, and comments addressed.