Add token binding

[cpp11nullptr]

Purpose

Introduce a “token binding scenario” for confidential client (app-only) token acquisition and downstream API calls:

• Bind access tokens to a client certificate (expected cnf claim – thumbprint / key reference).
• Use mutual TLS (mTLS) when calling downstream APIs.
• Support Bearer / PoP / mTLS protocol selection via AuthorizationHeaderProviderOptions.ProtocolScheme.
• Provide a service collection extension (one-line enablement) wiring token acquisition + binding + downstream calls.

High-level scenario

1. Developer enables token binding scenario via new service collection extension (PR states: “add service collection extension to enable token binding”).
2. A binding certificate is sourced from ClientCredentials (direct cert or via Managed Identity).
3. Developer specifies a protocol scheme (e.g. ProtocolScheme = "Pop" or future ProtocolScheme = "mtls-pop" / "mtls") in AuthorizationHeaderProviderOptions.
4. Token acquisition (client credentials flow) is configured accordingly; Entra ID returns a token containing a binding claim (cnf) when certificate binding is active.
5. The authorization header provider produces the header (currently Bearer <token>; protocol-specific transformations for schemes like Pop are applied internally).
6. An mTLS-capable HTTP client presents the same certificate during TLS handshake.
7. Downstream API validates that presented client certificate matches token’s cnf claim (x5t thumbprint).
8. Fallback path: if no certificate is available (or protocol does not require it), a regular unbound token is retrieved.