[Engineering task] Add mTLS PoP support for WithCertificate(() => x509) (DynamicCertificateClientCredential)

[gladjohn]

Task type

Development

Description

Currently MtlsPopParametersInitializer.InitExplicitMtlsPopAsync handles:

1. CertificateClientCredential — uses static Certificate property
2. IClientSignedAssertionProvider — calls GetAssertionAsync for the cert
3. Everything else — throws

DynamicCertificateClientCredential (backing WithCertificate(() => x509)) matches none of these cases, so .WithMtlsProofOfPossession() throws at preflight.

Solution

Fix: Add a case in InitExplicitMtlsPopAsync for CertificateAndClaimsClientCredential (the base class) — call its provider to resolve the cert, then pass it to InitMtlsPopParameters. Same for TryInitImplicitBearerOverMtlsAsync.

The credential material path already handles mTLS mode correctly (returns empty params + cert). Only the preflight needs wiring.

Scope: MtlsPopParametersInitializer.cs + tests. Feature branch recommended.

[gladjohn]

@neha-bhargava @bgavrilMS can you please review this task? just want to make sure we have all the details in here. I do have a DRAFT PR out there but making sure the task is correct.

[bgavrilMS]

A token request should generate at most 1 credential resolution. In case of an MTLS token request, it will always request credential resolution.