feat(azure): forward credential_scopes to Azure AI Inference client

[mattatcha]

Summary

Adds a credential_scopes field to the native Azure AI Inference provider plus a matching AZURE_CREDENTIAL_SCOPES env var (comma-separated). The value is forwarded to ChatCompletionsClient / AsyncChatCompletionsClient when set, letting keyless / Entra-based callers target a specific Azure AD audience (e.g. https://cognitiveservices.azure.com/.default) without subclassing the provider. Matches the upstream azure.ai.inference SDK kwarg of the same name.

Key Changes

• New credential_scopes: list[str] | None field on AzureCompletion
• _normalize_azure_fields reads AZURE_CREDENTIAL_SCOPES (comma-separated) when not provided explicitly
• _make_client_kwargs re-reads the env on lazy build (matching the existing AZURE_API_KEY / AZURE_ENDPOINT lazy pattern) and forwards credential_scopes to the SDK only when set
• to_config_dict round-trips the field
• 6 new unit tests cover explicit arg, default omission, env var, env-overridden-by-arg, lazy env read, and to_config_dict round-trip; full Azure module: 68 passed, 0 failed

---

Note

Medium Risk
Touches Azure authentication/client initialization by altering token audience configuration, which can affect connectivity for keyless Entra flows. Changes are gated (only applied when scopes are provided) and covered by targeted tests.

Overview
Adds a new optional credential_scopes field to AzureCompletion, populated from either a constructor arg or the comma-separated AZURE_CREDENTIAL_SCOPES env var.

Updates lazy client construction to re-read scopes at build time and only forward credential_scopes into the Azure AI Inference client kwargs when set; to_config_dict now round-trips the value. Includes new unit tests covering explicit vs default behavior, env parsing/precedence, lazy env reads, and config serialization.

^{Reviewed by Cursor Bugbot for commit 68a64e9. Bugbot is set up for automated code reviews on this repo. Configure here.}