Enable seamless webview-to-broker transitions for server-driven enrollment flows

[Copilot]

During authentication, servers may require device enrollment (e.g., Intune profile installation) via external flow before continuing. The authentication request must remain active throughout: embedded webview → ASWebAuthenticationSession → broker/SSO extension.

Response detection and header extraction

• MSIDWebProfileInstallTriggerResponse detects msauth://installProfile, extracts x-intune-url and x-intune-token from HTTP response headers
• MSIDWebInstallProfileResponse detects msauth://profileInstalled completion callback
• HTTP response propagation: embedded webview stores in MSIDWebviewSession.lastHTTPResponse, flows through completion chain to factory via new overload methods

State-preserving coordinator

MSIDWebviewTransitionCoordinator manages transitions without request cancellation:

• suspendEmbeddedWebview() hides UI, preserves completion handlers and state
• launchExternalSession() creates ASWebAuthenticationSession with URL and headers (iOS 18+ additionalHeaderFields)
• dismissSuspendedEmbeddedWebview() cancels and releases for context switch
• Generic API supports any external session flow

Broker handoff on enrollment completion

After msauth://profileInstalled:

// Dismiss both webviews
self.transitionCoordinator.externalSessionHandler = nil;
[self.transitionCoordinator dismissSuspendedEmbeddedWebview];

// Switch to broker - managed device auth continues in SSO extension
MSIDBrokerInteractiveController *broker = 
    [[MSIDBrokerInteractiveController alloc] 
     initWithInteractiveRequestParameters:self.interactiveRequestParamaters
                     tokenRequestProvider:self.tokenRequestProvider
                        brokerInstallLink:nil
                                    error:&error];
[broker acquireToken:completionBlock];

Controller orchestrates flow (embedded webview only detects and returns responses), following existing MSIDWebWPJResponse pattern. Navigation canceled at trigger detection but completion handler not invoked—request remains active until broker completes.

Server contract

# Trigger (embedded webview)
HTTP/1.1 302 Found
Location: msauth://installProfile
x-intune-url: https://intune.endpoint/install
x-intune-token: <auth-token>

# Completion (ASWebAuthenticationSession)
HTTP/1.1 302 Found
Location: msauth://profileInstalled

ASWebAuthenticationSession request includes token header (iOS 18+).

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[azure-pipelines]

This pull request does not update changelog.txt.

Please consider if this change would be noticeable to a partner or user and either update changelog.txt or resolve this conversation.