[RFC-0010] Add multi-tenant workload identity support for Azure Blob Storage

[dipti-pai]

Part of: fluxcd/flux2#5022

Changes include:

• Use auth pkg to create Azure token credential to enable controller/object-level workload identity and pass this to Azure SDK.
• Doc update to remove deprecated AAD pod identity docs for buckets.

Tested controller-level/object-level scenario, caching - metrics shared below.

1. If object level workload identity feature gate is disabled, the Bucket source goes into a Stalled state.

Status:
  Conditions:
    Last Transition Time:  2025-08-26T16:52:35Z
    Message:               to use spec.serviceAccountName for provider authentication please enable the ObjectLevelWorkloadIdentity feature gate in the controller
    Observed Generation:   6
    Reason:                FeatureGateDisabled
    Status:                True
    Type:                  Stalled
    Last Transition Time:  2025-08-26T16:52:35Z
    Message:               to use spec.serviceAccountName for provider authentication please enable the ObjectLevelWorkloadIdentity feature gate in the controller
    Observed Generation:   6
    Reason:                FeatureGateDisabled
    Status:                False
    Type:                  Ready
    Last Transition Time:  2025-08-26T16:52:35Z
    Message:               to use spec.serviceAccountName for provider authentication please enable the ObjectLevelWorkloadIdentity feature gate in the controller
    Observed Generation:   6
    Reason:                FeatureGateDisabled
    Status:                True
    Type:                  FetchFailed

2. Cache metrics for success scenarios.

# TYPE gotk_token_cache_events_total counter
gotk_token_cache_events_total{event_type="cache_hit",kind="Bucket",name="azure-public",namespace="default",operation="reconcile"} 42
gotk_token_cache_events_total{event_type="cache_miss",kind="Bucket",name="azure-public",namespace="default",operation="reconcile"} 1

[cappyzawa]

LGTM with a nit

[matheuscscp]

LGTM! 🚀