[OIDC 1] Add basic Entra ID token validation

[joelverhagen]

Progress on #10212.

This adds an IEntraIdTokenValidator interface which accepts a parsed JWT (JSON web token) and performs basic Entra ID validation. This will be used by higher level code in a future PR.

The goal of this class is to assert that a given JWT is issued by Entra ID and is valid. The following checks are performed:

1. The JWT signature is valid per Entra ID's signing keys, fetched via JWKS. This is done inside ConfigurationManager<OpenIdConnectConfiguration>.
2. The issuer is an expected Entra ID value (iss claim and issuer property on the key). This is done via AadIssuerValidator.GetAadIssuerValidator and EnableAadSigningKeyIssuerValidation.
3. The token is not expired (nbf and exp claims). This is done inside JsonWebTokenHandler.ValidateTokenAsync.
4. The token has a valid audience (aud claim). A valid aud claim is our configured app client ID. This is done inside JsonWebTokenHandler.ValidateTokenAsync.

Other validations like replay protection, matching tenant ID/object ID, etc will be done elsewhere.

This minimal set of validations mimic the OWIN integration in Microsoft.Identity.Web:
https://github.com/AzureAD/microsoft-identity-web/blob/011bd155ce3ddedeb43daa7348e09584cfa20552/src/Microsoft.Identity.Web.OWIN/AppBuilderExtension.cs#L62-L73

[joelverhagen]

From NuGetGallery's perspective, any tenant is allowed, thus the common endpoint. The tenant ID per accepted service principal will be validated elsewhere.