[MSAL] Conditional Access

## Description of the new feature
Typical scenario to support: the ARM endpoint doesn't need MFA however storage data plane endpoint needs, user first login in to ARM endpoint without MFA, then access data plane endpoint which needs MFA.

## Proposed implementation details (optional)

The issue names MSAL, the ARM endpoint, and the storage data plane endpoint but no files or tests. Start by locating the authentication entry points for those two endpoint types, then define and verify a flow where ARM login without MFA can trigger MFA when data-plane access requires it.

Written by the indexing model from the issue text.