Feature: Replicate intune-portals device enrollment steps and mimic ms-identity-broker dbus-interface

Nobody has claimed this yet.

### Is there an existing request for this feature?

- [X] I have searched the existing issues and found none that matched mine

### Describe the feature

So when you are in a company that has been infested by ms you not only login via azure but also your device has to be enrolled prior to being able to login.

The existing closed source solution is comprised of:
* microsoft-identity-broker that runs for the user and distributes the authenticated client token to any other user application
* microsoft-identtiy-device-broker which runs on the system level -- its role is not clear to me - maybe it plays a role in device enrollment
* intune-portal an electron application to perform the login, but also device enrollment

So intune is a secondary login application, that you execute after being already logged in. The whole system has
has stability issues, and even if it works it needs several retries.
Usually the identity brokers fail to recover any stored client data, and then fails to recover until you remove any relevant data. If that happens you spent roughly half an hour to reset and re-enroll. It is insane that

Right now the authd based solution cannot be used because of two reasons:
* Missing device enrollment: even though the login flow works, the tenant will not allow me to log in if the device has not been enrolled prior - and the device key is sent with the login.
* Different identity broker dbus interface: Due to the spread of the existing ms solution there are already a bunch of plugins, i.e. for firefox that rely on the dbus interface of the (broken) ms-identity-broker

The later should be easy to fix - or could even be solved externally with another broker that relays the auth data..
The former is a blocker.

### Describe the ideal solution

Implement a robust device enrollment system for azure tennants, that follows the behavior of intune wo the bugs.
Please take slow tennant reaction times for device approval of over 15 minutes into account.

Implement a the ms-id-broker dbus protocol to support existing plugins

### Alternatives and current workarounds

not applicable

### System information and logs

not applicable

### Relevant information

_No response_

### Double check your logs

- [X] I have redacted any sensitive information from the logs

No files, tests, or entry points are named. Start by tracing authd’s existing login flow and defining the device-enrollment and ms-id-broker D-Bus compatibility boundaries. Done means supporting enrollment, slow tenant approval responses, and the requested broker protocol without relying on the existing Microsoft implementation.

Written by the indexing model from the issue text.