Backport AOT-safe auth provider to release/7.0 branch

## Summary

Backport the AOT-safe authentication provider work from PR #4348 to the `release/7.0` branch for the 7.0.2 milestone.

## Parent Issue

Child of #4193

## Scope

Cherry-pick or port the following changes from `dev/paul/aot` → `release/7.0`:

- Public API: `SqlAuthenticationProviderManager.GetProvider()`, `SetProvider()`, `ApplicationClientId`
- Feature switch: `Microsoft.Data.SqlClient.EnableReflectionBasedAuthenticationProviderDiscovery`
- `[FeatureSwitchDefinition]` on .NET 9+
- `ILLink.Substitutions.xml` for .NET 8
- ILLink substitutions split (cross-platform vs Windows-only)
- Ref assembly updates
- Unit tests (`SqlAuthenticationProviderManagerTests`, `ILLinkSubstitutionsTests`)
- AotCompatibility test app

## Acceptance Criteria

- [ ] All changes compile on `release/7.0` branch
- [ ] Unit tests pass
- [ ] Native AOT publish succeeds with feature switch disabled
- [ ] `LoadAzureExtensionProvider` confirmed trimmed in ILC map
- [ ] ILLink resources correctly embedded per platform

## Notes

- May require adaptation if `release/7.0` has diverged from the main development branch
- Verify TFM differences (7.0 branch may not target net10.0)