Allow Azure Service Bus connection string options with certificate or workload identity sign-in #5977

Describe the suggested improvement

Is your improvement related to a problem? Please describe.

ServiceControl can sign in to Azure Service Bus with a service principal that uses a certificate or a secret, or with workload identity. It does this when the connection string is just the namespace host name, such as my-namespace.servicebus.windows.net.

You cannot add any option to that host name. As soon as you add TopicName, EnablePartitioning, HierarchyNamespace or any other option, ServiceControl switches to a shared access key or to managed identity, and sign-in fails.

So customers who can't use shared access keys and don't run on Azure compute can't set a custom topic name, partitioning or a hierarchy namespace. The errors also misleading. One blames a missing shared access key, the other blames managed identity.

Describe the suggested solution

Add a new Authentication value, for example Authentication=Default Azure Credential, that uses the same sign-in as the plain host name and allows every option:

Endpoint=sb://my-namespace.servicebus.windows.net/;Authentication=Default Azure Credential;TopicName=my-topic

• Reject ClientId with this value, because the client ID comes from AZURE_CLIENT_ID.
• When an Endpoint= string has no key and no Authentication value, fail with a message that lists the supported forms.
• Update the docs and remove the note that options don't work with certificate sign-in.

The change stays inside ConnectionStringParser. Everything that reads the connection string already handles this kind of sign-in, including the usage report.

Describe alternatives you've considered

• Use the default sign-in whenever an Endpoint= string has no key. Rejected: a typo in a key name would silently switch the sign-in.
• Leave it as it is and document the limit. That keeps these customers blocked.

Additional Context

No response