core: add sovereign cloud support via AzureAd configuration

[corinagum]

Summary

Enables sovereign cloud (GCC-High, DoD, China) Bot Framework token validation by making the three cloud-dependent values in JwtExtensions configurable, mirroring the IConfiguration pattern already used by UserTokenClient.

Three new properties on BotConfig, populated by BotConfig.Resolve:

Property	Config key	Default	Purpose
EntraInstance	AzureAd:Instance	https://login.microsoftonline.com/	Entra login instance for validating Entra-issued tokens (standard Microsoft.Identity.Web key, stays in the AzureAd section)
OpenIdMetadataUrl	BotFramework:OpenIdMetadataUrl	https://login.botframework.com/v1/.well-known/openid-configuration	Bot Framework OIDC metadata endpoint used to fetch signing keys for inbound BF tokens
BotTokenIssuer	BotFramework:BotTokenIssuer	https://api.botframework.com	Expected iss claim on inbound Bot Framework tokens

Bot-Framework-specific keys live in a separate BotFramework configuration section so they are not conflated with MSAL's AzureAd section. Instance remains under AzureAd because it is a standard Microsoft.Identity.Web key.

Each override is validated as an absolute URI in BotConfig.Resolve; malformed values throw InvalidOperationException with the section:key path so misconfiguration fails fast instead of deferring to a runtime JWT failure.

JwtExtensions.AddTeamsJwtBearer resolves BotConfig once and uses these values in both the issuer-signing-key resolver (ResolveSigningAuthority) and the issuer validator (ValidateTeamsIssuer). When IConfiguration is not registered (manual-credentials callers on a plain ServiceCollection), all three fall back to the public-cloud defaults.

Example sovereign config (USGov)

{
  "AzureAd": {
    "TenantId": "...",
    "ClientId": "...",
    "Instance": "https://login.microsoftonline.us/"
  },
  "BotFramework": {
    "OpenIdMetadataUrl": "https://login.botframework.azure.us/v1/.well-known/openid-configuration",
    "BotTokenIssuer": "https://api.botframework.us"
  }
}

Out of scope

• Authority fallback for EntraInstance is intentionally not implemented. Instance is the canonical Microsoft.Identity.Web field and matches the keys Microsoft Learn uses for sovereign cloud configuration.
• BotConfig source formats other than the AzureAd schema are not extended in this PR.
• v1.0 sts.windows.net issuer validation remains accepted (covers commercial v1.0 tokens).

Test plan

• dotnet build core/core.slnx clean (0 warnings, 0 errors)
• dotnet test core/test/Microsoft.Teams.Core.UnitTests (130 passed)
• Default values returned when overrides absent
• Configured values used for sovereign US Gov and China clouds
• Sovereign BF tokens route to the configured OpenIdMetadataUrl for key resolution
• Malformed URI in any of the three keys throws InvalidOperationException with the section:key path
• BotFramework section is read independently of the AzureAd section name
• Manual AddBotAuthentication(clientId, tenantId) overload does not require IConfiguration

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds configurable cloud-specific authentication endpoints to core bot authentication so sovereign cloud deployments can override Bot Framework OIDC metadata and Entra login instance values via configuration.

Changes:

• Adds OpenIdMetadataUrl and EntraInstance to BotConfig, sourced from the configured auth section with public-cloud defaults.
• Updates JWT signing-key discovery to use these resolved values instead of hardcoded constants.
• Adds unit tests covering default and overridden BotConfig values.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
core/src/Microsoft.Teams.Core/Hosting/BotConfig.cs	Adds configurable sovereign-cloud endpoint properties and resolves them from configuration.
core/src/Microsoft.Teams.Core/Hosting/JwtExtensions.cs	Uses resolved Bot Framework and Entra endpoint values during JWT signing-key discovery.
core/test/Microsoft.Teams.Core.UnitTests/Hosting/BotConfigTests.cs	Adds tests for default and configured endpoint resolution.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[rido-min]

added some comments.

Not sure the new fields should live inside the AzureAd section... maybe in a new section ?

@corinagum does this PR includes the changes in #483?

[corinagum]

@rido-min regarding your question:

@corinagum does this PR includes the changes in #483?

No, #483 is a separate v1 issuer fix; v1 issuer exists across every cloud. This PR doesn't port those changes because sts.windows.net/{effectiveTeanant}/ branch was already in core ValidateTeamsIssuer.