feat: add OBO authentication support

[hallvictoria]

Purpose

Adds support for OAuth 2.0 On-Behalf-Of (OBO) token flow, enabling Azure Functions agents to call downstream APIs (MCP servers, backend services) using the authenticated end-user's identity rather than only the function app's managed identity. -

• Pre-consent only - no interactive flows
• When no user token is present or OBO fails, falls back to managed identity

Configuration
Enable OBO in agents.config.yaml (global):

auth:
  obo:
    enabled: true
    client_id: $AZURE_CLIENT_ID
    client_secret: $AZURE_CLIENT_SECRET
    tenant_id: $AZURE_TENANT_ID
    downstream_scopes:
      graph: "https://graph.microsoft.com/.default"

Configure MCP server with OBO in mcp.json:

{
  "servers": {
    "my-backend": {
      "url": "https://api.example.com/mcp",
      "auth": {
        "type": "obo",
        "scope": "api://my-backend-api/.default"
      }
    }
  }
}

Does this introduce a breaking change?

[ ] Yes
[ ] No

Pull Request Type

What kind of change does this Pull Request introduce?

[ ] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

• Get the code

git clone https://github.com/Azure/azure-functions-agents-runtime.git
cd azure-functions-agents-runtime
git checkout [branch-name]
pip install -e .

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information