redisconn: add an Azure Entra ID credentials provider for Azure Managed Redis #466

Summary

Add an Azure Entra ID credential provider to redisconn, so clients can authenticate to Azure Managed Redis with a short-lived Entra token instead of a static password.

Why

Azure Managed Redis does not support static Redis ACL users. Per-identity permissions (custom data access policies) are only available to Entra identities, whose "password" is an access token that expires (about an hour). A static Password stops working once the token expires, so the only static option is the instance access key, which grants full access to the whole instance.

redisconn already has the seam for this: DynamicAuth.CredentialsProviderContext is called for every new connection and is threaded through the standalone, cluster and sentinel clients. What is missing is an Azure implementation. postgres/azuread.go already does the equivalent for Azure Database for PostgreSQL and is the pattern to follow.

Proposed shape

• A constructor (or a DynamicAuth backend field mirroring postgres.DynamicAuthConfig.AzureAD) built on azidentity.DefaultAzureCredential: workload identity, managed identity, AZURE_CLIENT_ID for a user-assigned identity.
• Token scope https://redis.azure.com/.default.
• Username: the object ID of the identity, which Azure Managed Redis requires. Allow an explicit override, and derive it from the token's oid claim when unset.
• Construct the credential once; azidentity caches and refreshes the token, so the per-connection cost is a cached GetToken.
• ConnMaxLifetime set below the token lifetime so pooled connections re-authenticate before the token expires.

Acceptance criteria

• Unit: the provider returns the identity's object ID as username and a token minted for https://redis.azure.com/.default as password, using a fake azcore.TokenCredential. No AT because the token exchange with Azure cannot run in CI; the connection path is covered by the existing CredentialsProviderContext tests.
• Unit: an error from GetToken surfaces as a wrapped auth error and fails the dial, never a silent fallback to no auth.
• Unit: setting both a static Password and the Azure provider is refused by Config.Validate, as it is for any other DynamicAuth.
• Unit: the cluster and sentinel client builders carry the Azure provider through, matching the existing CredentialsProviderContext coverage.
• Package docs describe the Azure Managed Redis requirements: TLS, port 10000, and an access policy assignment for the identity.