Implemented abac support for tag and manifest'

[keithy1012]

Purpose of the PR

• Adds ABAC support for acr tag list, acr tag delete, acr manifest list, and acr manifest delete commands. These commands currently fail with a 401 unauthorized error on ABAC-enabled registries because newAcrCLIClientWithBearerAuth requests the wildcard scope repository::, which ABAC registries silently ignore. Since these commands already know the target repository, we detect ABAC registries using the aad_identity JWT claim and request a repo-scoped token instead.

Fixes #

• internal/api/acrsdk.go: Added hasAadIdentityClaim() for ABAC detection. Updated GetAcrCLIClientWithAuth and newAcrCLIClientWithBearerAuth to accept repoName and request repo-scoped tokens for ABAC registries.
• cmd/acr/tag.go: Pass repoName to GetAcrCLICLientWithAuth in tag list and delete.
• cmd/acr/manifest.go: Pass repoName to GetAcrCLIClientWithAuth in manifest list and manifest delete.
• internal/api/acrsdk_test.go: Updated GetAcrCLIClientWithAuth signatures in test

[lizMSFT]

Instead of updating newAcrCLIClientWithBearerAuth and GetAcrCLIClientWithAuth with some duplicate ABAC logic that already exists in RefreshTokenForAbac, can we simplify this by keeping GetAcrCLIClientWithAuth with its original signature, and have the tag/manifest commands call RefreshTokenForAbac after client creation (the same pattern purge already uses)?

like:

// In tag.go / manifest.go:
acrClient, err := api.GetAcrCLIClientWithAuth(loginURL, params.username, params.password, params.configs)
if err != nil {
    return err
}
// For ABAC registries, scope the token to the target repository.
if acrClient.IsAbac() {
    if err := acrClient.RefreshTokenForAbac(context.Background(), []string{params.repoName}); err != nil {
        return err
    }
}

[lizMSFT]

I reviewed the cssc and annotate commands, both also call GetAcrTags acorss multiple repositories, so they are have the same ABAC gap and would need the same batch pattern as purge command. That's a larger change though, and cssc command is still in preview. Let's keep this PR focused on tag and manifest command. I will create a separate work item to track ABAC support for annotate and cssc

[lizMSFT]

overall lgtm. please add the unit tests for the tag and manifest ABAC code path

[lizMSFT]

nit: the context.Background() is redundant here, move the ctx declaration above the ABAC block and reuse it (same in all 4 call sites)
reference: https://github.com/Azure/acr-cli/blob/main/cmd/acr/purge.go#L133C1-L134C1

[lizMSFT]

Let's still keep the comment here