Add Managed Identity v2 KeyGuard mTLS PoP support - #1059

Summary

Adds production-shaped Managed Identity v2 mTLS support for Java using Windows
VBS KeyGuard and optional Microsoft Azure Attestation.

Java retains native interop only for KeyGuard/CNG signing and attestation.
JCA/JSSE owns TLS, and mTLS PoP callers receive a reusable
IMtlsBindingContext for independent downstream Java HTTP calls.

Reviewer entry point: managed-identity-v2-mtls-pop-review-guide.md

Architecture

ManagedIdentityApplication
  -> IMDS v2 platform metadata
  -> KeyGuard non-exportable RSA key
  -> optional MAA attestation
  -> IMDS v2 binding certificate
  -> normal MSAL OAuth token pipeline over JSSE mTLS
  -> mtls_pop token + reusable IMtlsBindingContext

Native signing remains limited to:

JSSE
  -> X509ExtendedKeyManager
  -> CngRsaPrivateKey
  -> CngSignatureSpi
  -> NCryptSignHash
  -> VBS KeyGuard

Changes

• Adds managed-identity mTLS PoP and binding-aware token caching keyed by token
  type, complete leaf-certificate DER SHA-256 identity, and attestation mode.
• Routes the ESTS mTLS exchange through the normal MSAL token pipeline for
  claims, client capabilities, telemetry, correlation IDs, retries, error
  handling, and response parsing.
• Adds an optional Windows extension for CNG, KeyGuard, CSR generation,
  attestation, certificate rotation, and reusable JSSE binding contexts.
• Bundles and verifies the Microsoft-signed
  Microsoft.Azure.Security.KeyGuardAttestation 1.1.5
  AttestationClientLib.dll.
• Requires exact token_type=mtls_pop, HTTPS token endpoints, IMDS-specific
  retry behavior, validated IMDS response origin, and disabled redirects for
  credential-bound requests.
• Defines IMtlsCapableHttpClient for custom transports and fails fast when a
  custom client does not consume request-specific mTLS configuration.
• Detects and recreates stale per-boot KeyGuard keys using a private signing
  liveness probe.
• Keeps the manual Key Vault E2E application in a separate profile-only module.

.NET parity follow-up

The following parity changes are included in this PR branch:

• Moves the public attestation opt-in out of core and into the optional
  com.microsoft.azure:msal4j-key-attestation artifact through
  ManagedIdentityAttestationExtensions.withAttestationSupport(...), matching
  the MSAL.NET package boundary.
• Adds bearer-over-mTLS through withRequestOverMtls(). It authenticates the
  ESTS connection with KeyGuard, requests token_type=bearer, uses a distinct
  cache partition, and intentionally returns no downstream binding context.
• Adds SLF4J-backed native attestation logging with correlation IDs, safe native
  callback lifetime, and suppression of raw native debug payloads.
• Adds MSAL_MI_DISABLE_IMDS_V2; true or 1 disables v2, capability
  discovery reports no mTLS binding, and explicit PoP or bearer-over-mTLS
  requests fail before metadata, key, CSR, certificate, or attestation work.
• Keeps the KeyGuard key container persistent but the issued certificate and
  binding context process-memory only. No Windows certificate-store persistence
  is required.
• Does not add token-revocation reminting, claims-triggered certificate
  replacement, or bypass_cache.

The optional bounded capability-discovery timeout proposed in MSAL.NET issue
#6180 remains a separate follow-up. It is useful for credential-chain failover,
but is not currently shipped by MSAL.NET and requires a Java cancellation and
transport-budget contract rather than a superficial future timeout.

Validation

• Full msal4j-sdk tests pass.
• Targeted optional-package API and native logger tests pass.
• Production classes remain Java 8 compatible.
• The production extension and shaded E2E JAR contain the verified native DLL;
  the production extension excludes the manual E2E app.
• Live validation passed on a Windows Server 2025 Trusted Launch Azure VM:
  • acquired an attested mtls_pop token;
  • returned the binding certificate and reusable JSSE SSLContext;
  • verified JWT cnf.x5t#S256 against SHA-256 of the complete leaf certificate
    DER;
  • independently called a token-binding-enforced Azure Key Vault with
    HttpsURLConnection and received HTTP 200;
  • retried the same token without its binding certificate and received HTTP
    401 Unauthorized;
  • reacquired through MSAL and received TokenSource.CACHE with the matching
    live binding context;
  • force-refreshed and received TokenSource.IDENTITY_PROVIDER, then completed
    another HTTP 200 Key Vault call;
  • acquired an ordinary Bearer token over attested mTLS, exposed no binding
    context, and verified the second acquisition was a cache hit;
  • enabled MSAL_MI_DISABLE_IMDS_V2 and verified mTLS PoP failed before native
    attestation work.

Security properties

• Private-key bytes are never exported into Java memory.
• TLS is performed by Java JCA/JSSE, not WinHTTP or Schannel as the HTTP stack.
• Attestation failures fail closed when attestation is requested.
• Ordinary bearer, bearer-over-mTLS, mTLS PoP, attested, and unattested cache
  entries cannot cross-hit.
• Same-key certificate renewal creates a new token-cache partition because the
  complete certificate DER changes.
• Credential-bound redirects are disabled.
• Custom HTTP clients fail fast unless they support request-specific mTLS.
• Retired native key handles are cleaned after certificate expiry.

MSAL.NET parity gap analysis

A feature-by-feature comparison, intentional platform differences, validation evidence, and prioritized remaining release gaps are documented in managed-identity-v2-dotnet-java-parity-gap-analysis.md.