feat: add OBO authentication support

[hallvictoria]

Purpose

Adds support for propagating authenticated user identity to downstream MCP servers.

• OAuth 2.0 On-Behalf-Of (OBO) token exchange.
• EasyAuth header forwarding.
• Managed identity fallback.
• Request-scoped identity propagation for streaming and non-streaming agent runs.

Configuration
Enable OBO in agents.config.yaml (global):

auth:
  obo:
    enabled: true
    client_id: $AZURE_CLIENT_ID
    client_secret: $AZURE_CLIENT_SECRET
    tenant_id: $AZURE_TENANT_ID

Configure MCP server with OBO in mcp.json:

{
  "servers": {
    "my-backend": {
      "url": "https://api.example.com/mcp",
      "auth": {
        "type": "obo",
        "scope": "api://my-backend-api/.default"
      }
    }
  }
}

Behavior
For MCP servers configured with auth.type: obo, the runtime:

• Forwards configured or trusted headers when available.
• Otherwise exchanges the inbound user token for a downstream token using OBO.
• Falls back to managed identity when user identity or OBO is unavailable.
• OBO tokens are cached in memory until near expiration. Existing MCP configurations remain unchanged.

Production deployments must use EasyAuth or another trusted authentication layer. The runtime trusts inbound identity headers and does not validate them itself.

Does this introduce a breaking change?

[ ] Yes
[ ] No

Pull Request Type

What kind of change does this Pull Request introduce?

[ ] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

• Get the code

git clone https://github.com/Azure/azure-functions-agents-runtime.git
cd azure-functions-agents-runtime
git checkout [branch-name]
pip install -e .

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information