fix: Support reading STACKIT_SERVICE_CONNECTION_ID on Azure Pipelines

[JorTurFer]

Description

Fixes #1668

Changes

Read STACKIT_SERVICE_CONNECTION_ID on Azure Pipelines

When running in Azure DevOps with the STACKIT Service Connection, the CLI now passes STACKIT_SERVICE_CONNECTION_ID to oidcadapters.RequestAzureDevOpsOIDCToken, the same way the Terraform provider does. Without this, the CLI and Terraform get OIDC tokens with a different sub when they run in the same pipeline, so the same federated identity provider assertions can't serve both.

Store the session on stackit auth activate-service-account --use-oidc

Until now, activate-service-account --use-oidc printed Authenticated via Workload Identity Federation. but never stored anything, so the next command (e.g. stackit project list) failed with you are not authenticated. With a service account key, activate-service-account stores the session and the following commands use it; this PR does the same for WIF:

• New auth flow sa_wif (AUTH_FLOW_WORKLOAD_IDENTITY). activate-service-account --use-oidc stores it together with the service account email and the custom token endpoint, unless --only-print-access-token is set.
• Only the email is stored, never the federated token. On every command, the WIF flow is rebuilt from the stored email and the OIDC token source in the environment (OIDCTokenFunc), and the SDK requests a new access token when needed. The token source must still be available, e.g. in the same CI job.
• AuthenticationConfig, GetValidAccessToken and GetProfileEmail support the new flow. As a result, project list/create, organization list, curl, auth get-access-token and ske kubeconfig login work after activating, and the session time limit applies like for the other service account flows.
• The WIF branch of AuthenticateServiceAccount set the flow type to sa_key (unused before because nothing was written). It now uses sa_wif and clears SERVICE_ACCOUNT_KEY/PRIVATE_KEY, so leftovers from a previous key activation don't stay in the storage.
• AUTHENTICATION.md documents activate-service-account --use-oidc as the way to use WIF, and STACKIT_SERVICE_CONNECTION_ID.

Note: STACKIT_USE_OIDC=1 without activate-service-account

This PR doesn't change that mode: the env-based path in AuthenticationConfig is untouched. While testing, we noticed it only works for commands that just call an API. Commands that read the stored session fail when nothing was activated:

Command	Failure
project list (without --parent-id/--member), project create	get email of authenticated user: error getting profile email. email is empty
organization list	the request is sent with an empty member
auth get-access-token, curl, ske kubeconfig login	UserSessionExpired() fails parsing the empty SESSION_EXPIRES_AT_UNIX

With this PR, activate-service-account --use-oidc followed by any command works, consistent with the key flow. We'd suggest treating activate-service-account as the supported path and discussing in a follow-up issue whether the env-only mode should be fixed or deprecated.

Checklist

• Issue was linked above
• Code format was applied: make fmt
• Docs are up-to-date: make generate-docs (will be checked by CI)
• Unit tests got implemented or updated
• Unit tests are passing: make test (will be checked by CI)
• No linter issues: make lint (will be checked by CI)

🤖 Generated with Claude Code