[Feature Request] Add token-binding (mTLS PoP) support to OidcIdpSignedAssertionProvider #3851

Context

PR #3839 added token-binding (mTLS PoP) support to ManagedIdentityClientAssertion
via two new public virtuals on ClientAssertionProviderBase:

• virtual bool SupportsTokenBinding => false;
• virtual Task<ClientSignedAssertion?> GetSignedAssertionWithBindingAsync(...)

OidcIdpSignedAssertionProvider (in Microsoft.Identity.Web.OidcFIC) inherits
the defaults, so it currently produces bearer-only JWT assertions. Per Bogdan Gavril (@bgavrilMS)'s
PR review, OIDC FIC should also support binding.

This issue tracks that follow-up work, split out of #3839 to keep the MSI scope
landable.

Problem statement

OidcIdpSignedAssertionProvider.GetClientAssertionAsync calls
_tokenAcquirer.GetTokenForAppAsync(...) against an external OIDC IdP and returns
the resulting JWT. To produce a ClientSignedAssertion with a non-null
TokenBindingCertificate, we need a binding cert paired with the OIDC-issued
assertion — but the external OIDC IdP cannot itself issue that cert.

Open design question

Where does the binding certificate come from when the assertion is OIDC-issued?
Three options to evaluate:

1. Paired credential — declarative config lists an OIDC FIC credential
   alongside a cert/KeyGuard credential; provider stitches the two together.
2. OidcFIC-owned cert source — provider owns a key (KeyGuard / cert store /
   ephemeral) and produces the cert internally.
3. New abstraction — IBindingCertificateSource injectable into the
   provider, decoupling assertion source from cert source.

Bogdan Gavril (@bgavrilMS) — would appreciate your steer on the preferred shape before we cut
code.

Acceptance criteria

• OidcIdpSignedAssertionProvider overrides SupportsTokenBinding and
  GetSignedAssertionWithBindingAsync.
• Returned ClientSignedAssertion.TokenBindingCertificate is non-null and
  usable by MSAL's WithMtlsProofOfPossession().
• Cert-source design documented in the OIDC FIC config schema and devex doc.
• Unit tests covering: bound success path, missing-cert config error,
  assertion/cert mismatch.
• E2E test exercising end-to-end mTLS PoP flow with OIDC-issued FIC.

References

• PR Add MSI mTLS PoP support: pure MI + FIC-with-MI (impl for devex #3832) #3839 — introduces the SupportsTokenBinding extension point
• src/Microsoft.Identity.Web.OidcFIC/OidcIdpSignedAssertionProvider.cs — target
• src/Microsoft.Identity.Web.Certificateless/ManagedIdentityClientAssertion.cs —
  reference impl pattern