Add managed identity E2E tests + self-hosted CI stages (MSAL Go #641 parity) (#948)

* test(managed-identity): add real MI E2E tests + self-hosted CI stages

Mirror the MSAL Go MI E2E setup (#641). Add tests/test_mi_e2e.py, which acquires
ARM tokens for the system-assigned identity and each user-assigned binding
(client id / resource id / object id) over IMDS, plus the system-assigned identity
over Azure Arc, asserting the first call reaches the identity provider and the
second is served from the cache (token_source). Uses the same lab identities as
the Go / .NET MI E2E tests.

Wire two OneBranch stages that run the test on the self-hosted lab pools
(MISEManagedIdentity VM/IMDS and MISEAZUREARC), gated so IMDS cases run only on
the IMDS pool (MSAL_TEST_MI_IMDS) and the Arc case only on an Arc machine; the
test self-skips everywhere else. Exclude the E2E file from the unit stage.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5ad57850-7d1f-4b9a-bf9f-723d69a9687c

* ci(mi-e2e): run pytest directly on self-hosted pools; drop runtime pip install

The self-hosted MI E2E pools carry the toolchain (like Go/.NET); pre-provision
msal's deps + pytest on them instead of installing at run time. This removes the
runtime "pip install", which the Azure Arc pool cannot do anyway - its egress TLS
inspection blocks files.pythonhosted.org (the same restriction MSAL Go documented).
Also drop --timeout so pytest-timeout is not required.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5ad57850-7d1f-4b9a-bf9f-723d69a9687c

* ci(mi-e2e): resolve python.exe by full path so the step doesn't depend on the agent PATH

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5ad57850-7d1f-4b9a-bf9f-723d69a9687c

* test(mi-e2e): redact tokens in logs, close session, fork-guard self-hosted stages

Address PR review feedback:
- Assert access_token present on the cached (second) acquisition before indexing.
- Never log token material: summarize error results to safe fields only, and
  compare the cached token to the original via SHA-256 digest instead of raw values.
- Close the requests.Session in a finally block.
- Add a stage-level fork guard so forked-PR code never runs on the self-hosted
  MISEManagedIdentity / MISEAZUREARC pools.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5ad57850-7d1f-4b9a-bf9f-723d69a9687c

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5ad57850-7d1f-4b9a-bf9f-723d69a9687c