Ensure TenantIdResolver performs case-insensitive tenant ID comparisons

[Copilot]

This PR updates the TenantIdResolver to perform case-insensitive tenant ID comparisons, making it more resilient to odd casing that may come from WWW-Authenticate challenges.

Problem

The TenantIdResolver.Resolve method was performing case-sensitive comparisons when validating and resolving tenant IDs. This could cause issues when tenant ID values returned from WWW-Authenticate challenges have different casing than expected.

Solution

Updated all string comparisons in TenantIdResolver.cs to use StringComparison.OrdinalIgnoreCase:

1. Context vs Explicit Tenant Comparison (line 24): Changed context.TenantId != explicitTenantId to use case-insensitive comparison
2. ADFS Tenant Detection (lines 26 & 39): Changed explicitTenantId == Constants.AdfsTenantId comparisons to be case-insensitive
3. Resolved vs Explicit Tenant Check (line 43): Changed resolvedTenantId != explicitTenantId to use case-insensitive comparison

Testing

Added comprehensive test coverage with three new test methods:

• ResolveWithCaseInsensitiveTenantIdComparison: Verifies mixed case tenant IDs are handled correctly
• ResolveWithCaseInsensitiveAdfsTenantId: Tests that ADFS tenant ID detection works with various casings (ADFS, adfs, Adfs)
• ResolveWithCaseInsensitiveComparisonForAllowedTenants: Ensures case-insensitive matching against additionally allowed tenants

All existing tests continue to pass, confirming no regressions were introduced.

Example

Previously, these would be treated as different tenants:

// Case-sensitive comparison would fail
var context = new TokenRequestContext(scopes, tenantId: "TENANT-ID");
resolver.Resolve("tenant-id", context, allowedTenants); // Would not match

// ADFS detection would fail with different casing
resolver.Resolve("ADFS", context, allowedTenants); // Would not be recognized as ADFS

Now these comparisons work correctly regardless of casing differences.

Fixes #51693.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull Request Overview

This PR updates the TenantIdResolver to perform case-insensitive tenant ID comparisons, making authentication more resilient to casing differences that may occur in WWW-Authenticate challenges.

• Updated all string comparisons in TenantIdResolver.cs to use StringComparison.OrdinalIgnoreCase
• Added comprehensive test coverage with three new test methods to verify case-insensitive behavior
• Updated the changelog to document the bug fix

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
sdk/identity/Azure.Identity/src/TenantIdResolver.cs	Updated four string comparison operations to use case-insensitive comparison
sdk/identity/Azure.Identity/tests/TenantIdResolverTests.cs	Added three new test methods to verify case-insensitive tenant ID handling
sdk/identity/Azure.Identity/CHANGELOG.md	Added entry documenting the case-insensitive tenant ID comparison fix

[christothes]

/check-enforcer override