azrepos: add a binding manager to store org-user maps

Add a new binding manager component that can be used to 'bind' user
accounts to Azure DevOps organisations. This enables the Azure Repos
host provider to attempt silent authentication requests via MSAL - to
attempt to use an existing access token from the cache.

We only allow binding at the organisation level (and not any other
level) as this is the most common scenario: one user for an entire Azure
DevOps organisation.

If the user wishes to override the chosen user for a particular clone
they can do so by binding the user to the local repository
configuration, rather than the default global configuration.

Furthermore, if the user wishes to use a different user account for a
particular remote within a repository, they can set the username in the
remote URL.