Support managed identity + application authentication

**Related command**
`az login`

**Is your feature request related to a problem? Please describe.**
MSAL previously has a draft PR https://github.com/AzureAD/microsoft-authentication-library-for-python/pull/560 on supporting **managed identity + application FIC** authentication, but this PR is not completed yet.

There is an internal work item of migrating to **managed identity + multitenant application** (MI+CCA). Below is some sample code:

- Python: https://gist.github.com/amritpal-singh-98/92c5b7627e7ea0dc1491e03b7b834310
- .NET: https://gist.github.com/AtOMiCNebula/988383241cd1837a6c3faf6a353cecea

Currently Azure CLI doesn't support MI+CCA, but there is a workaround:

```sh
# First log in with managed identity
az login --identity

# Acquire an access token for token exchange
token=$(az account get-access-token --scope api://AzureADTokenExchange/.default --query accessToken --output tsv)

# Use the above token as an OIDC token to log into the multitenant application
az login --service-principal --username --federated-token $token
```

As `$token` is passed via `--federated-token`, https://github.com/Azure/azure-cli/issues/28708 will be hit. It is better for MSAL to support MI+CCA authentication and refresh the managed identity's token on demand.

Then Azure CLI can expose this feature via something like

```
az login --service-principal --username --fic-mi
```

After that, [AzureCLI@2 - Azure CLI v2](https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/azure-cli-v2?view=azure-pipelines) and [Azure Login Action](https://github.com/Azure/login) task also need to be updated to support this command.