Support Azure DevOps Git authentication via azure identity library

[dsteeley]

Azure Devops auth via azure identity

It's possible to use the azure identity library to generate Bearer tokens that can be used for Azure DevOps git operations.
Would you be open to a PR expanding Renovate's Azure DevOps support to include authenticating with the azure_identity library.

This would support self-hosted scenarios where the environment is already authenticated removing the need for passing long lived secrets to the pipeline.

[rarkins]

How long are such tokens valid for?

[dsteeley]

I believe 60-90 minutes. I suggest an implementation where a new token is generated for each repository to mitigate the risk of expiry.

[rarkins]

See #30930 for a generic approach to this.

An alternative would be to support commonly used libraries "first class" by adding awareness of them to Renovate, such as hostType=azure-identity

[dsteeley]

I'm keen to help get this working so will reply on your linked discussion.

I agree that the generic approach will result in this being supportable rather than special casing the azure host type. It may be required to add your alternative suggestion of hostType=azure-identity when supporting bearer token authentication. Package versions can be queried via the azure host type which I'm not sure would be authenticated through the generic mechanism listed above?