Azure CLI task fails: AADSTS700024: Client assertion is not within its valid time range

Acquiring access token with expired OIDC token fails with:

> ERROR: AADSTS700024: Client assertion is not within its valid time range. Current time: 2024-04-05T23:01:54.2089203Z, assertion valid from 2024-04-05T22:40:41.0000000Z, expiry time of assertion 2024-04-05T22:50:41.0000000Z. Review the documentation at https://docs.microsoft.com/azure/active-directory/develop/active-directory-certificate-credentials

As the error indicates, the OIDC token is only valid for 10 minutes. After it is passed to `az login` via `--federated-token`, Azure CLI cannot get a new OIDC token after the OIDC token expires.

This is the designed v1 behavior of OIDC token support (#19853).

However, as Azure DevOps task **AzureCLI@2** (https://github.com/microsoft/azure-pipelines-tasks/pull/17633) and GitHub Action **azure/login@v2** (https://github.com/Azure/login/pull/147) have supported OIDC token authentication, and it is recommended to use [workload identity federation](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation), this limitation is becoming more prevailing.

## Possible solutions

1. OIDC token provider such as Azure DevOps or GitHub should provide an option to control the expiry time of the OIDC token to make it at least as long as the task duration.
2. Design and implement a v2 solution that uses a managed-identity-like interface which allows MSAL/Azure CLI to refresh OIDC token.

## References

- https://github.com/Azure/login/issues/180
- https://github.com/Azure/login/issues/372
- IcM 490937309
- IcM 491234676
- Email: Workload identity federation in Azure Pipelines fails with AADSTS700024