[DNM]feat: add Azure cross-tenant support for external tables

[jiaqizho]

This adds the C++ side for Azure cross-tenant access. The new fs.azure_client_id and fs.azure_tenant_id properties are parsed into the filesystem config, and AzureFileSystem can now use our Managed Identity to exchange for a customer-tenant storage bearer without holding the customer's account key.

For Iceberg, ABFS/ABFSS reads can now go through a custom ADLS storage factory when cross-tenant options are present. The bridge handles the Managed Identity to AAD token exchange, injects the bearer into ADLS requests, and keeps the normal Azure path unchanged when cross-tenant mode is not enabled.

For Lance, az:// reads now get a per-call custom object store session with a bearer-token credential provider. This lets Lance read customer Azure storage through the same cross-tenant flow while filter ing out account keys, SAS tokens, and other credentials that could bypass the intended path.

[sre-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jiaqizho
To complete the pull request process, please assign sunby after the PR has been reviewed.
You can assign the PR to them by writing /assign @sunby in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jiaqizho]

current azure iceberg support need iceberg-rust 0.9(rust 1.92)

[codecov]

Codecov Report

❌ Patch coverage is 8.88889% with 123 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.03%. Comparing base (bb76fae) to head (4f364c6).

Files with missing lines	Patch %	Lines
...filesystem/azure/azure_cross_tenant_credential.cpp	0.00%	104 Missing ⚠️
cpp/src/filesystem/azure/azurefs.cc	0.00%	6 Missing ⚠️
cpp/src/format/iceberg/iceberg_common.cpp	37.50%	5 Missing ⚠️
cpp/src/format/lance/lance_common.cpp	37.50%	5 Missing ⚠️
cpp/src/filesystem/azure/azure_fs_producer.cpp	50.00%	2 Missing ⚠️
...e/filesystem/azure/azure_cross_tenant_credential.h	0.00%	1 Missing ⚠️

❌ Your patch check has failed because the patch coverage (8.88%) is below the target coverage (60.00%). You can increase the patch coverage or adjust the target coverage.
❌ Your project check has failed because the head coverage (74.90%) is below the target coverage (75.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #507      +/-   ##
==========================================
- Coverage   72.66%   72.03%   -0.63%     
==========================================
  Files         148      150       +2     
  Lines       13815    13945     +130     
  Branches     2060     2075      +15     
==========================================
+ Hits        10038    10045       +7     
- Misses       3777     3900     +123     

Flag	Coverage Δ
cpp	74.90% <8.88%> (-0.73%)	⬇️
python	44.77% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.