Support additional national / sovereign clouds (cloud name not in go-autorest's built-in list)

## Summary

`canipull` aborts with `Unknown Azure cloud name: ` when run on AKS nodes deployed in a national / sovereign cloud whose identifier is not one of the five built-in names recognized by `github.com/Azure/go-autorest/autorest/azure.EnvironmentFromName` (i.e. anything other than `AzurePublicCloud`, `AzureUSGovernmentCloud`, `AzureChinaCloud`, `AzureGermanCloud`, or `AzureStackCloud` with a properly-shaped metadata file pointed to by `AZURE_ENVIRONMENT_FILEPATH`).

In several newer national clouds, the node provisioner writes:

- `/etc/kubernetes/azure.json` with `"cloud": "AzureStackCloud"` (reusing the Stack identifier as a catch-all for non-public clouds), and
- a companion `/etc/kubernetes/akscustom.json` containing the cloud-specific endpoints (ARM, AAD, ACR DNS suffix, etc.).

Because canipull v0.1.0 only calls `az.EnvironmentFromName(cfg.Cloud)` and never consults the companion file, the very first step of `validateMsiAuth` / `validateServicePrincipalAuth` fails and the tool exits with `AzureCloudUnknown` before any MSI / ACR check is performed. This is the entire blast radius — DNS, CNAME and location detection all succeed, but the managed-identity / token-exchange checks never run.

This makes `az aks check-acr` (which shells out to this container) unusable on every cluster in those national clouds. There is no flag or invocation that bypasses the failure.

## Repro

On an AKS node in any national cloud where `/etc/kubernetes/azure.json` reports `"cloud": "AzureStackCloud"` but no `AZURE_ENVIRONMENT_FILEPATH`-shaped metadata file is provided:

```
canipull -v6 myacr.
```

Output:

```
Checking host name resolution (...): SUCCEEDED
Canonical name for ACR (...): ...
ACR location:
Checking managed identity...
Unknown Azure cloud name: AzureStackCloud
```

Exit code: `AzureCloudUnknown`.

## Root cause

[`main.go`](https://github.com/Azure/aks-canipull/blob/main/main.go) `validateMsiAuth` / `validateServicePrincipalAuth`:

```go
env, err := az.EnvironmentFromName(cfg.Cloud)
if err != nil {
logger.V(2).Info("Unknown Azure cloud name: %s", cfg.Cloud)
return exitcode.AzureCloudUnknown
}
```

`go-autorest`'s `EnvironmentFromName` only resolves the 4 hardcoded public clouds, plus `AzureStackCloud` if the process can read a metadata JSON file pointed to by `AZURE_ENVIRONMENT_FILEPATH`. Neither condition holds inside canipull's pod on these national clouds.

## Requested behavior

Make canipull cloud-environment-aware in a way that does not require shipping a new build for every new sovereign cloud:

1. **Honor `AZURE_ENVIRONMENT_FILEPATH`** end-to-end (pass it through, document it). The CLI / wrapper can mount the companion file and set the env var.
2. **Fallback: read the companion `/etc/kubernetes/akscustom.json`** (or a `--cloud-config` flag) when `cfg.Cloud` is unknown to `go-autorest`, and construct an `azure.Environment` manually from its `activeDirectoryEndpoint`, `resourceManagerEndpoint`, `tokenAudience`, ACR DNS suffix, etc. The schema of that file is already well-defined by the Kubernetes Azure cloud provider.
3. **Use a configurable IMDS endpoint.** Today `msiMetadataEndpoint` is hardcoded to `http://169.254.169.254/metadata/identity/oauth2/token`. That happens to be the same across clouds, but should be overridable for completeness / testability.
4. **Improve the error message** in the meantime: tell the user *which* file was inspected, *what* cloud name was found, and that they can set `AZURE_ENVIRONMENT_FILEPATH` to a metadata JSON to unblock the run.

## Why this matters

`canipull` is the engine behind `az aks check-acr`, which is the only first-party diagnostic for ACR pull connectivity on AKS. Customers in any newer national cloud cannot use it at all today. The fix is a few lines in the cloud-environment resolution path and a small wrapper change in azure-cli to mount the companion file and set the env var.

Happy to send a PR if the direction (1+2) is acceptable.

Start with main.go, especially validateMsiAuth and validateServicePrincipalAuth, and reproduce the canipull command against an AzureStackCloud configuration without AZURE_ENVIRONMENT_FILEPATH. Inspect the documented /etc/kubernetes/akscustom.json and environment-file paths, then verify that unknown sovereign clouds resolve their endpoints, configurable IMDS behavior works, and the error explains the inspected file and remediation.

Written by the indexing model from the issue text.