Adopt Azure SDK configurable credential (Azure.Identity ConfigurableCredential) for provisioning

## Problem

`DefaultTokenCredentialProvider` maintains a manual switch statement that maps `AzureProvisionerOptions.CredentialSource` strings to individually constructed credential types. This approach:

- Requires adding code for each new credential type (currently 7 of 13 available types)
- Does not expose per-credential options (e.g., `CredentialProcessTimeout`, `ManagedIdentityIdKind`, `Subscription`) — each must be added as a custom Aspire option
- Has a drift bug: `VisualStudioCode` is listed in `AllowedValues` but never handled in the switch
- Cannot support `ChainedTokenCredential` or advanced scenarios like federated identity

## Proposed Solution

Azure.Identity 1.18.0+ (Aspire's current pinned version) provides experimental `ConfigurableCredential` and DI integration (`WithAzureCredential`, `AddAzureClient`) that allows credentials to be fully configured via `IConfiguration`:

```json
{
"Azure": {
"Credential": {
"CredentialSource": "AzureCliCredential",
"TenantId": "...",
"CredentialProcessTimeout": "00:02:00",
"AdditionallyAllowedTenants": ["*"]
}
}
}
```

This supports all 13 credential types with their full option surfaces, JSON schema IntelliSense in appsettings.json, and eliminates the need for custom Aspire options like `CredentialProcessTimeoutSeconds`.

## Migration Considerations

- **Publish-mode default**: Aspire defaults to `AzureCliCredential` in publish mode when no source is set. The SDK defaults to `DefaultAzureCredential`. A shim is needed to preserve Aspire's behavior.
- **Backward compatibility**: `Azure__CredentialSource` (the flat option) should continue to work as a fallback, translating to the new `Azure:Credential:CredentialSource` path.
- **Experimental API**: The SDK integration is marked `SCME0002`. This should be explicitly acknowledged.
- **Schema migration**: `AspireAzureConfigurationSchema.json` needs updating to reference the new `Credential` section instead of the flat `CredentialSource` property.
- **Deprecation path**: `AzureProvisionerOptions.CredentialSource` can be marked obsolete with guidance to use `Azure:Credential:CredentialSource`.

## Related

- #15872 — Credential timeout fix (interim solution using custom `CredentialProcessTimeoutSeconds`)
- #13904 — Azure CLI timeout error in GitHub Actions
- [azure-sdk-for-net#55034](https://github.com/Azure/azure-sdk-for-net/pull/55034) — IConfiguration support in System.ClientModel
- [azure-sdk-for-net#57483](https://github.com/Azure/azure-sdk-for-net/pull/57483) — ConfigurationSchema.json for Azure.Identity

cc @eerhardt @m-nash