FEAT: Add browser-session authentication for M365 Copilot

[Adrian Gavrila (adrian-gavrila)]

Description

Adds interactive browser-session authentication for the M365 Copilot WebSocket target.

The new BrowserSessionCopilotAuthenticator:

• Uses a persistent Microsoft Edge profile for user-driven authentication.
• Supports MFA, Conditional Access, passwordless authentication, and account selection.
• Captures Copilot tokens without storing user credentials.
• Keeps tokens in memory and refreshes them on use near expiry.
• Retains a minimized browser session for automatic token recapture.
• Supports standalone scripts and Windows Jupyter notebooks.
• Isolates personas through separate browser profile paths.
• Preserves the existing automated-credential and manual-token authenticators.

This also updates the default M365 Copilot ChatHub endpoint to substrate.svc.cloud.microsoft while leaving the separate image-upload endpoint unchanged.

Related work: ADO #12409 and ADO #12568.

The M365 Copilot WebSocket protocol remains undocumented and may change.

Tests and Documentation

• Added unit coverage for token validation, expiry handling, concurrent capture, cancellation cleanup, browser lifecycle, URL filtering, persona isolation, and event-loop ownership.
• Existing Copilot authenticator and WebSocket target tests pass.
• Ruff, ty, and repository pre-commit checks pass.
• Live-tested text, multi-turn, parallel, image, standalone browser-session, Jupyter, and explicit token-recapture flows.
• Added an executable browser-session authentication example to the paired Jupytext documentation.
• Jupytext strict synchronization passes.
• Natural near-expiry renewal soak test is pending.