No first-class Azure Pipelines authentication step, so every pipeline hand-copies four variables between tasks

### Problem

The `setup-azd` Azure Pipelines task installs `azd`. It does not authenticate. Authenticating with a workload identity federation service connection requires the `AZURESUBSCRIPTION_*` variables, which are only populated inside a task bound to that service connection. A plain script step cannot see them.

Every pipeline therefore repeats the same boilerplate: run an `AzureCLI@2` task purely to copy three variables out via `task.setvariable`, then map those plus `SYSTEM_ACCESSTOKEN` back in as `env` on the step that runs `azd auth login`. This pattern appears in this repository's own pipelines, in `eng/pipelines/templates/steps/configure-oidc-auth.yml` and `eng/pipelines/templates/jobs/build-cli.yml`.

### Impact

- Roughly a dozen lines of mechanical boilerplate per pipeline, with several silent-failure modes. `SYSTEM_ACCESSTOKEN` is not exposed to scripts unless explicitly mapped, and omitting it produces an authentication failure whose message does not point at the omission.
- The variable names are not discoverable from the task, so authors copy them from samples and have no way to validate them until a run fails.
- The comparable path on the GitHub provider is a single action plus a permission grant, so the Azure DevOps experience is materially worse for the same outcome.
- The boilerplate must be duplicated into every template that needs authentication, and it drifts.

### Proposed requirement

Provide a supported Azure Pipelines step that authenticates `azd` against a service connection, either as an input on `setup-azd` or as a separate task:

```yaml
- task: setup-azd@1
inputs:
azureSubscription: my-service-connection
version: 1.x.y
```

The step should handle the service connection binding, the access token, and the login, and should fail with an actionable message when the pipeline is missing a required grant.

### Acceptance criteria

- [ ] A supported task authenticates `azd` from a service connection without manual variable copying
- [ ] The task handles the system access token without the author mapping it by hand
- [ ] A missing or misconfigured service connection produces an actionable error
- [ ] Version pinning is supported
- [ ] Documentation shows the single-step pattern as the recommended approach