[Identity] Update client_credential dict

[pvaneck]

Ensure that private_key is passed as a string to MSAL, following their documented expectations.

Closes: #36578

[Copilot]

Pull request overview

This PR updates azure-identity certificate-based credential handling to ensure the client_credential dictionary passed to MSAL uses a string (str) for private_key, aligning with MSAL’s documented expectations and addressing issue #36578.

Changes:

• Convert client_credential["private_key"] from PEM bytes to a UTF-8 string before passing to MSAL.
• Broaden AadClientCertificate to accept pem_bytes/password as either bytes or str (encoding str to UTF-8 internally).
• Add/adjust tests to validate private_key is a str and update expectations for passphrase when a string password is provided.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
sdk/identity/azure-identity/azure/identity/_credentials/certificate.py	Decodes PEM bytes to str for private_key in the MSAL client credential dict; refactors password handling.
sdk/identity/azure-identity/azure/identity/_internal/aadclient_certificate.py	Expands accepted input types (bytes/str) for PEM and password and normalizes to bytes for cryptography.
sdk/identity/azure-identity/tests/test_obo.py	Updates assertions to expect string passphrase for string password input and validates private_key is a str.
sdk/identity/azure-identity/tests/test_certificate_credential.py	Adds a new test for get_client_credential output types (but currently contains a syntax-breaking indentation issue).

Comments suppressed due to low confidence (1)

sdk/identity/azure-identity/azure/identity/_credentials/certificate.py:141

• The docstring for get_client_credential still documents password as bytes, but the function signature now accepts str | bytes. Please update the :param entries to match the accepted types (and/or adjust the wording to clarify encoding behavior), so generated docs stay accurate.

    """Load a certificate from a filesystem path or bytes, return it as a dict suitable for msal.ClientApplication.

    :param str certificate_path: Path to a PEM or PKCS12 certificate file.
    :param bytes password: The certificate's password, if any.
    :param bytes certificate_data: The PEM or PKCS12 certificate's bytes.
    :param bool send_certificate_chain: Whether to send the certificate chain. Defaults to False.