Add caller-provided key AT PoP sample

[Antonio Alwan (antonioalwan)]

Summary

Adds an iOS sample for acquiring Access Token Proof-of-Possession tokens with a caller-provided RSA key pair. The sample creates or loads a persistent RSA key from Keychain, passes it to MSAL through MSALExternalKeyPair, and demonstrates interactive and silent token acquisition.

Key changes

• Add ExternalPopKeyStore to create, persist, and reload the caller-owned RSA key pair.
• Add an External AT PoP action to the sample UI.
• Configure MSALAuthenticationSchemePop with the external key pair and the SHR validation endpoint.
• Demonstrate both interactive and silent External AT PoP token acquisition.
• Point the CocoaPods dependency to the MSAL dev branch so the sample follows the current development API.

Does this introduce a breaking change?

• Yes
• No

Pull Request Type

• Bugfix
• Feature
• Code style update
• Refactoring with no functional or API changes
• Documentation content changes
• Other

Dependencies

• [minor] [feature]: Add external key support for AT PoP AzureAD/microsoft-authentication-library-common-for-objc#1934
• [minor][feature]: Add caller-provided keys for AT PoP AzureAD/microsoft-authentication-library-for-objc#3072

Both dependency PRs are merged. The sample resolves MSAL from the dev branch.

How to validate

1. Run pod install.
2. Build and launch the MSALiOS scheme.
3. Select Acquire External AT PoP Token.
4. Complete interactive authentication when prompted.
5. Confirm that the log reports successful token acquisition and displays the external key ID.
6. Select the action again and confirm silent token acquisition succeeds for the current account.

What to check

• The RSA private key remains caller-owned and stored in Keychain.
• The same external key pair is used for token binding and SHR signing.
• Interactive acquisition falls back correctly when no current account exists or interaction is required.
• Existing Microsoft Graph sample behavior remains unchanged.