backend/azurerm: adding support for authenticating via MSAL in addition to ADAL

[tombuildsstuff]

This PR adds support for using MSAL instead of ADAL for getting auth tokens in the AzureRM backend, meaning that Microsoft Graph Tokens will be used rather than Azure Active Directory Graph Tokens.

For the moment this is an opt-in feature - however in a future release we'll flip the default from ADAL to MSAL since ADAL is deprecated.

[tombuildsstuff]

Client Certificate Tests:

$ go test -v ./internal/backend/remote-state/azure -timeout=60m -run="(TestBackendADALServicePrincipalClientCertificateBasic|TestBackendMSALServicePrincipalClientCertificateBasic)"
=== RUN   TestBackendADALServicePrincipalClientCertificateBasic
--- PASS: TestBackendADALServicePrincipalClientCertificateBasic (113.47s)
=== RUN   TestBackendMSALServicePrincipalClientCertificateBasic
--- PASS: TestBackendMSALServicePrincipalClientCertificateBasic (116.29s)
PASS
ok  	github.com/hashicorp/terraform/internal/backend/remote-state/azure	230.178s

MSI Tests:

$ ARM_ENVIRONMENT=public ARM_TENANT_ID="..." ARM_SUBSCRIPTION_ID="..." ARM_USE_MSI=true TF_RUNNING_IN_AZURE=true TF_ACC=1 ARM_LOCATION=westeurope go test -v ./internal/backend/remote-state/azure/ -timeout=60m -run="(TestRemoteClientManagedServiceIdentityBasic|TestBackendADALManagedServiceIdentityBasic|TestBackendMSALManagedServiceIdentityBasic)"
=== RUN   TestBackendADALManagedServiceIdentityBasic
--- PASS: TestBackendADALManagedServiceIdentityBasic (113.71s)
=== RUN   TestBackendMSALManagedServiceIdentityBasic
--- PASS: TestBackendMSALManagedServiceIdentityBasic (117.17s)
=== RUN   TestRemoteClientManagedServiceIdentityBasic
--- PASS: TestRemoteClientManagedServiceIdentityBasic (105.22s)
PASS
ok  	github.com/hashicorp/terraform/internal/backend/remote-state/azure	336.125s

Other Tests:

$ TF_ACC=1 envchain azurerm go test -v ./internal/backend/remote-state/azure -timeout=60m                                                                                                                          (f/azure-backend-updates)
=== RUN   TestBackend_impl
--- PASS: TestBackend_impl (0.00s)
=== RUN   TestBackendConfig
--- PASS: TestBackendConfig (0.00s)
=== RUN   TestBackendAccessKeyBasic
--- PASS: TestBackendAccessKeyBasic (109.42s)
=== RUN   TestBackendSASTokenBasic
--- PASS: TestBackendSASTokenBasic (104.24s)
=== RUN   TestBackendADALAzureADAuthBasic
--- PASS: TestBackendADALAzureADAuthBasic (95.10s)
=== RUN   TestBackendADALManagedServiceIdentityBasic
   helpers_test.go:38: Skipping test since not running in Azure
--- SKIP: TestBackendADALManagedServiceIdentityBasic (0.00s)
=== RUN   TestBackendADALServicePrincipalClientCertificateBasic
   backend_test.go:160: Skipping since `ARM_CLIENT_CERTIFICATE_PATH` is not specified!
--- SKIP: TestBackendADALServicePrincipalClientCertificateBasic (0.00s)
=== RUN   TestBackendADALServicePrincipalClientSecretBasic
--- PASS: TestBackendADALServicePrincipalClientSecretBasic (112.20s)
=== RUN   TestBackendADALServicePrincipalClientSecretCustomEndpoint
   backend_test.go:226: Skipping as ARM_ENDPOINT isn't configured
--- SKIP: TestBackendADALServicePrincipalClientSecretCustomEndpoint (0.00s)
=== RUN   TestBackendMSALAzureADAuthBasic
--- PASS: TestBackendMSALAzureADAuthBasic (104.03s)
=== RUN   TestBackendMSALManagedServiceIdentityBasic
   helpers_test.go:38: Skipping test since not running in Azure
--- SKIP: TestBackendMSALManagedServiceIdentityBasic (0.00s)
=== RUN   TestBackendMSALServicePrincipalClientCertificateBasic
   backend_test.go:320: Skipping since `ARM_CLIENT_CERTIFICATE_PATH` is not specified!
--- SKIP: TestBackendMSALServicePrincipalClientCertificateBasic (0.00s)
=== RUN   TestBackendMSALServicePrincipalClientSecretBasic
--- PASS: TestBackendMSALServicePrincipalClientSecretBasic (113.41s)
=== RUN   TestBackendMSALServicePrincipalClientSecretCustomEndpoint
   backend_test.go:388: Skipping as ARM_ENDPOINT isn't configured
--- SKIP: TestBackendMSALServicePrincipalClientSecretCustomEndpoint (0.00s)
=== RUN   TestBackendAccessKeyLocked
--- PASS: TestBackendAccessKeyLocked (105.80s)
=== RUN   TestBackendServicePrincipalLocked
--- PASS: TestBackendServicePrincipalLocked (105.39s)
=== RUN   TestRemoteClient_impl
--- PASS: TestRemoteClient_impl (0.00s)
=== RUN   TestRemoteClientAccessKeyBasic
--- PASS: TestRemoteClientAccessKeyBasic (101.15s)
=== RUN   TestRemoteClientManagedServiceIdentityBasic
   helpers_test.go:38: Skipping test since not running in Azure
--- SKIP: TestRemoteClientManagedServiceIdentityBasic (0.00s)
=== RUN   TestRemoteClientSasTokenBasic
--- PASS: TestRemoteClientSasTokenBasic (101.25s)
=== RUN   TestRemoteClientServicePrincipalBasic
--- PASS: TestRemoteClientServicePrincipalBasic (102.12s)
=== RUN   TestRemoteClientAccessKeyLocks
--- PASS: TestRemoteClientAccessKeyLocks (101.11s)
=== RUN   TestRemoteClientServicePrincipalLocks
--- PASS: TestRemoteClientServicePrincipalLocks (105.56s)
=== RUN   TestPutMaintainsMetaData
--- PASS: TestPutMaintainsMetaData (101.07s)
PASS
ok  	github.com/hashicorp/terraform/internal/backend/remote-state/azure	1462.183s

[jackofallops]

LGTM 👍

[manicminer]

Awesome, thanks @tombuildsstuff. Just a couple small wording suggestions but otherwise LGTM 👍

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.