Add Workday hybrid flow authorization

[Mukesh Chaudhary (mukesh4139)]

Summary

• add /connect workday-hybrid routing and a stateless Dataverse authorization utility
• create or reuse delegated authorization and access-team records, then grant workflow access
• require explicit environment selection and Microsoft account authentication before changes
• surface sanitized Dataverse diagnostics, including request IDs and service error details

Validation

Automated

• python -m pytest tests/scripts/test_auth.py tests/scripts/test_discover.py tests/scripts/test_enable_workday_hybrid_flow_authorization.py tests/setup/test_connect_workday_hybrid.py -q
• 63 tests passed

Live Dataverse validation approach

After /connect workday-hybrid completes, validate the resulting authorization with read-only Dataverse Web API v9.2 calls:

1. Query delegatedauthorizations filtered by the supplied bot ID and require exactly one row with providertype = 3 (MCSBot).
2. Query teams through delegatedauthorizationid/botid and require exactly one linked row with teamtype = 1 (Access).
3. Query each requested workflows row by workflowid and confirm it exists and is activated.
4. Call RetrieveSharedPrincipalsAndAccess for each workflow and confirm the linked access team has an access mask containing WriteAccess.

These checks replay the same Dataverse relationships Flow-RP uses to resolve the Cosmos-backed agent and authorize its workflows. They are GET-only and do not modify tenant state.

Live validation result

/connect workday-hybrid completed successfully and the resulting Dataverse state was independently verified for bot 2e9a99eb-98ef-4a66-8783-87ec174d8a34:

• exactly one delegated authorization exists with provider type MCSBot
• exactly one linked access team exists with team type Access
• all three ESS Workday Runtime workflows exist and are activated
• every workflow is shared with that access team using ReadAccess, WriteAccess, AppendAccess, AppendToAccess, ShareAccess

The delegated authorization and workflow access for the supplied bot were successfully validated. The tenant environment URL is intentionally omitted from this PR.