cache credentials from AzureClusterIdentity

[nojnhuh]

What type of PR is this?
/kind feature

What this PR does / why we need it:

This PR leverages the credential cache added in #5211 for credentials defined in AzureClusterIdentity resources. This lets CAPZ save token handles between reconciles instead of re-authenticating every reconciliation loop.

These graphs show the reconciles involving authentication requests made by CAPZ when creating two workload clusters that used the same credentials before and after implementing the cache:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #1077

Special notes for your reviewer:

• cherry-pick candidate

The most interesting change here is in azure/scope/identity.go, which inserts the cache in place of the direct SDK calls. The rest of the changes plumb the cache created in main to there.

TODOs:

• squashed commits
• includes documentation
• adds unit tests

Release note:

CAPZ now caches credentials to reduce the number of authentication requests it makes to Entra

[codecov]

Codecov Report

Attention: Patch coverage is 76.84211% with 22 lines in your changes missing coverage. Please review.

Project coverage is 53.03%. Comparing base (7e9ebb9) to head (34b748e).
Report is 12 commits behind head on main.

Files with missing lines	Patch %	Lines
main.go	0.00%	10 Missing ⚠️
internal/test/env/env.go	0.00%	7 Missing ⚠️
controllers/helpers.go	54.54%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5283      +/-   ##
==========================================
+ Coverage   53.00%   53.03%   +0.03%     
==========================================
  Files         272      272              
  Lines       29429    29404      -25     
==========================================
- Hits        15598    15595       -3     
+ Misses      13027    13010      -17     
+ Partials      804      799       -5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

---

🚨 Try these New Features:

• Flaky Tests Detection - Detect and resolve failed and flaky tests

[jackfrancis]

why aren't we asserting the first response object?

[nojnhuh]

That value is returned by a mock defined by the test, so it doesn't really mean anything.

[nojnhuh]

The main validation of that is covered by verifying the arguments we pass to the p.cache.GetOrStore... calls in the cacheExpect of each test case.

[jackfrancis]

I see that GetTokenCredential returns non-nil every time err is nil, maybe I'm being extra-defensive and protecting against the possibility that GetTokenCredential changes and an undesirable outcome is identified only in the TokenCredential object.

Non-blocking.

[jackfrancis]

/lgtm
/approve

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: da43590508b97601bc43c1df3f70462dc8c96177

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jackfrancis

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jackfrancis]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[nojnhuh]

/retest