Test Service Principal with client cert auth

[thomas11]

Run the existing Key Vault test one more time, authenticating with client cert auth that had no test coverage until now.

Resolves #3494

Successful run (since the PR tests skip this one); the OIDC test failures are unrelated.

The certificate is newly created for this purpose only, via

openssl req -subj '/CN=myclientcertificate/O=Pulumi, Inc./ST=CA/C=US' \
    -new -newkey rsa:4096 -sha256 -days 730 -nodes -x509 -keyout ciCert.key -out ciCert.crt

openssl pkcs12 -export -macalg sha1 -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -password pass:REDACTED -out ciCert.pfx -inkey ciCert.key -in ciCert.crt

The cert and the password are added as GH secrets to this repo, as ARM_CLIENT_CERTIFICATE and ARM_CLIENT_CERTIFICATE_PASSWORD. The cert secret is the base64-encoded content of the .pfx file since GH secrets cannot be files.

The cert and the password are also added to 1Password in the "Azure credentials" entry.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 58.23%. Comparing base (182a0ad) to head (d5d0637).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3498      +/-   ##
==========================================
- Coverage   58.25%   58.23%   -0.02%     
==========================================
  Files          67       67              
  Lines        8420     8416       -4     
==========================================
- Hits         4905     4901       -4     
  Misses       3068     3068              
  Partials      447      447              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.

[danielrbradley]

Test looks good 👍

One question on a possible accidental comment.