feat(azure/cloud): support passing authentication credentials as variables

[gdrojas]

Problem

The `azure/cloud` module hardcoded `authentication = {}` with no way to pass Azure credentials via Terraform. The intended workflow was to fill them via the UI after `tofu apply`, but the UI does not display Cloud Providers with an empty `authentication` block and no parent to inherit from — creating a chicken-and-egg: the provider exists in the API but is invisible in the UI.

Confirmed by comparing `data_source.stored_keys` between a working provider (credentials filled post-creation) and a new one created with the current module:

Field	Working provider	New provider
`authentication.client_id`	✓	✗
`authentication.client_secret`	✓	✗
`authentication.subscription_id`	✓	✗
`authentication.tenant_id`	✓	✗

Fix

Add optional variables `client_id`, `client_secret` (sensitive), `subscription_id`, and `tenant_id` (all `default = null`).

The `authentication` block is built dynamically — only keys with non-null values are included:

```hcl
authentication = {
for k, v in {
client_id = var.client_id
client_secret = var.client_secret
subscription_id = var.subscription_id
tenant_id = var.tenant_id
} : k => v if v != null
}
```

A `precondition` enforces all-or-none: passing a partial set (e.g. only `client_id`) produces an inconsistent authentication block and is rejected at plan time.

This is non-breaking: when all variables are omitted, the expression produces `authentication = {}` — identical to the previous hardcoded behavior.

Inheritance — empirically verified

NullPlatform merges provider attributes across the NRN scope hierarchy (org → account → namespace). A provider created with `authentication = {}` inherits credentials from the nearest ancestor that has them set.

Verified by creating a provider at account level with `authentication = {}` where a base provider with real credentials existed:

Endpoint	Result
`GET /provider/{id}` (merged)	Returns parent's `authentication` block
`GET /provider/{id}?no_merge=true`	`authentication` absent — not stored locally
Same parent `tag.id` in both	Confirms the values come from the parent, not a copy

And without a parent at org level with `authentication = {}`: `authentication` is absent from the response entirely.