Address PR review (shahzaibj): eliminate double deserialization + nullability nit

- MsalBrokerResultAdapter.getAcquireTokenResultFromResultBundle: deserialize
  BrokerResult once at the top of the success branch instead of letting
  authenticationResultFromBundle and getOnboardingBlobFromBundle each
  deserialize the same bundle. Reuse the BrokerResult for both consumers.
- Add authenticationResultFromBrokerResult(BrokerResult) overload that builds
  ILocalAuthenticationResult from a pre-deserialized BrokerResult; the
  existing authenticationResultFromBundle now delegates to it (no behavior
  change for other callers).
- Add getOnboardingBlobFromBundle(BrokerResult) overload that returns the blob
  from a pre-deserialized BrokerResult without doing I/O. The original
  Bundle-taking overload is preserved for callers that don't already have
  a BrokerResult.
- BrokerResult.Builder.onboardingBlob: add 'final' to the parameter and
  '@nullable' annotation, matching the surrounding builder method style.

Author: wzhipan

common/src/main/java/com/microsoft/identity/common/internal/broker/BrokerResult.java

@@ -727,7 +727,7 @@ public Builder exceptionType(String exceptionType) {
             return this;
         }
 
-        public Builder onboardingBlob(String onboardingBlob) {
+        public Builder onboardingBlob(@Nullable final String onboardingBlob) {
             this.mOnboardingBlob = onboardingBlob;
             return this;
         }

common/src/main/java/com/microsoft/identity/common/internal/result/MsalBrokerResultAdapter.java

@@ -465,9 +465,16 @@ public Bundle bundleFromBaseExceptionForWebApps(@NonNull final BaseException exc
     @NonNull
     @Override
     public ILocalAuthenticationResult authenticationResultFromBundle(@NonNull final Bundle resultBundle) throws ClientException {
-        final String methodTag = TAG + ":authenticationResultFromBundle";
-        final BrokerResult brokerResult = brokerResultFromBundle(resultBundle);
+        return authenticationResultFromBrokerResult(brokerResultFromBundle(resultBundle));
+    }
 
+    /**
+     * Overload that builds the authentication result from an already-deserialized
+     * {@link BrokerResult}. Use this when the caller has the [BrokerResult] in hand
+     * to avoid a redundant deserialization of the result bundle.
+     */
+    public ILocalAuthenticationResult authenticationResultFromBrokerResult(@NonNull final BrokerResult brokerResult) throws ClientException {
+        final String methodTag = TAG + ":authenticationResultFromBrokerResult";
         Logger.info(methodTag, "Broker Result returned from Bundle, constructing authentication result");
 
         final List<ICacheRecord> tenantProfileCacheRecords = brokerResult.getTenantProfileData();
@@ -570,6 +577,9 @@ public BrokerPerformanceMetrics getBrokerPerformanceMetricsFromBundle(@NonNull f
      * Best-effort: returns null if the bundle cannot be deserialized into a BrokerResult
      * or if no blob is present. Telemetry failures must never fail an otherwise-successful
      * auth result. Blob contents are not logged (may carry sessionCorrelationId).
+     *
+     * If the caller has already deserialized the [BrokerResult], prefer the overload
+     * [getOnboardingBlobFromBundle(BrokerResult)] to avoid a second deserialization.
      */
     @Nullable
     @VisibleForTesting(otherwise = VisibleForTesting.PRIVATE)
@@ -584,6 +594,17 @@ public String getOnboardingBlobFromBundle(@NonNull final Bundle resultBundle) {
         }
     }
 
+    /**
+     * Overload that reads the onboarding telemetry blob from a {@link BrokerResult}
+     * that has already been deserialized by the caller. Use this when you already
+     * have a [BrokerResult] in hand to avoid a second deserialization of the bundle.
+     */
+    @Nullable
+    @VisibleForTesting(otherwise = VisibleForTesting.PRIVATE)
+    public String getOnboardingBlobFromBundle(@NonNull final BrokerResult brokerResult) {
+        return brokerResult.getOnboardingBlob();
+    }
+
     @NonNull
     @Override
     public AcquirePrtSsoTokenResult getAcquirePrtSsoTokenResultFromBundle(Bundle resultBundle) {
@@ -1036,9 +1057,14 @@ public AcquireTokenResult getDeviceCodeFlowTokenResultFromResultBundle(@NonNull
     AcquireTokenResult getAcquireTokenResultFromResultBundle(@NonNull final Bundle resultBundle) throws BaseException {
         final MsalBrokerResultAdapter resultAdapter = new MsalBrokerResultAdapter();
         if (resultBundle.getBoolean(AuthenticationConstants.Broker.BROKER_REQUEST_V2_SUCCESS)) {
+            // Deserialize BrokerResult once and reuse for both the local authentication result
+            // and the onboarding telemetry blob, instead of letting authenticationResultFromBundle
+            // and getOnboardingBlobFromBundle each pay the deserialization cost.
+            final BrokerResult brokerResult = resultAdapter.brokerResultFromBundle(resultBundle);
+
             final AcquireTokenResult acquireTokenResult = new AcquireTokenResult();
             acquireTokenResult.setLocalAuthenticationResult(
-                    resultAdapter.authenticationResultFromBundle(resultBundle)
+                    resultAdapter.authenticationResultFromBrokerResult(brokerResult)
             );
             // Set broker performance metrics if available
             final BrokerPerformanceMetrics metrics = resultAdapter.getBrokerPerformanceMetricsFromBundle(resultBundle);
@@ -1059,7 +1085,7 @@ AcquireTokenResult getAcquireTokenResultFromResultBundle(@NonNull final Bundle r
             }
 
             // Set onboarding telemetry blob if present (best-effort; never fails the result).
-            final String onboardingBlob = resultAdapter.getOnboardingBlobFromBundle(resultBundle);
+            final String onboardingBlob = resultAdapter.getOnboardingBlobFromBundle(brokerResult);
             if (onboardingBlob != null) {
                 acquireTokenResult.setOnboardingBlob(onboardingBlob);
             }