[Core] Annotate TokenCredential for auditing

[jsquire]

Summary

The focus of these changes is to annotate the TokenCredential methods that acquire a token as participants in security-related operations which callers may wish to consider auditing.

References and related

• Adding basic [CallerShouldAudit] support and initial support for Storage and Tables (#39345)

[azure-sdk]

API change check

API changes are not detected in this pull request.

[annelo-msft]

I don't have a good understanding of when we add this attribute to libraries, but I know there is established thinking about how we do it ... @jsquire, do we have this written down anywhere? Out of curiosity, what prompted us to add this to Token Credential now? Is it the first instance of adding it to a Core library type? (I am not pushing back, BTW, just seeking to leave a paper-trail to understand the topic better!)

[annelo-msft]

Also -- it looks like this didn't trigger a new APIView -- is this not considered a public API addition? Or is it not something we track in APIView?

[jsquire]

Also -- it looks like this didn't trigger a new APIView -- is this not considered a public API addition? Or is it not something we track in APIView?

It is not a change to the public API; the attribute added has internal visibility.

[jsquire]

I don't have a good understanding of when we add this attribute to libraries, but I know there is established thinking about how we do it ... @jsquire, do we have this written down anywhere? Out of curiosity, what prompted us to add this to Token Credential now? Is it the first instance of adding it to a Core library type? (I am not pushing back, BTW, just seeking to leave a paper-trail to understand the topic better!)

Forwarded you an email thread with context. The internal tracking item is here. The archboard recording and original issue can be found on the linked PR. @tg-msft owns this workstream, please feel free to reach out to him if you're looking for additional context.