[FEATURE] Fall back to native Git credential helper for Azure DevOps authentication

Is your feature request related to a problem? Please describe.

Azure DevOps Services dependencies currently require either ADO_APM_PAT or an active Azure CLI session (az login). When neither is available, APM does not fall back to the native Git credential helper, even when the same repository can be accessed successfully with Git itself:

git clone https://dev.azure.com/org/project/_git/repo

This is inconvenient for users who already authenticate to Azure DevOps through Git Credential Manager or another configured Git credential helper. It also makes ADO behave differently from other supported Git hosts where APM can delegate authentication to Git.

Describe the solution you'd like

When installing a package from Azure DevOps Services (dev.azure.com or a supported *.visualstudio.com URL), APM should use the native Git credential helper as a fallback when:

1. ADO_APM_PAT is not set; and
2. Azure CLI authentication is unavailable, not installed, or the user is not signed in.

The fallback should invoke Git using the user's existing credential-helper configuration, without requiring APM-specific environment variables or embedding credentials in repository URLs. The behavior should be equivalent to a direct git clone or git ls-remote against the same repository.

The intended authentication order would be:

1. ADO_APM_PAT;
2. Azure CLI bearer authentication from az login;
3. native Git credential helper;
4. an actionable authentication error if all methods fail.

The implementation should remain non-interactive in APM's subprocesses, preserve current credential redaction and isolation guarantees, and avoid changing Azure DevOps Server's existing PAT-only behavior unless explicitly intended. Tests should cover helper-based HTTPS authentication, unavailable az, PAT and bearer precedence, and failure diagnostics.

Describe alternatives you've considered

• Continue requiring ADO_APM_PAT, which duplicates credentials that users may already have stored in Git Credential Manager.
• Require users to run az login, which is not always available in minimal environments, containers, or setups where Git Credential Manager is the established authentication path.
• Use SSH URLs and SSH keys instead of HTTPS, which changes the dependency URL and is not always available for Azure DevOps users.

Additional context

Related authentication behavior is documented in Azure DevOps authentication.

I would be happy to help with reproduction, design feedback, or testing.

Start with docs/src/content/docs/getting-started/authentication.md and trace the existing Azure DevOps authentication flow described there. Review how PAT and Azure CLI bearer authentication are selected, then identify the tests needed for Git credential-helper fallback, precedence, non-interactive behavior, and failure diagnostics. Done means the documented authentication order works without changing Azure DevOps Server's existing PAT-only behavior.