feat: replace Azure SDK and google-cloud-auth with direct reqwest for credential vending (#6617)

## Summary

- Replace Azure SDK crates (`azure_core`, `azure_identity`,
`azure_storage`, `azure_storage_blobs`, `time`) and `google-cloud-auth`
with direct HTTP calls via `reqwest`
- Add `hmac` and `quick-xml` for Azure SAS signing and XML parsing (both
already transitive deps, zero compile cost)
- Add `ring` and `rustls-pki-types` for GCP service account JWT signing
(both already transitive deps)
- Add Workload Identity Federation (OIDC) support for both Azure and GCP
credential vending
- Reduce Cargo.lock by ~500 lines of removed transitive dependencies

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jackye1995