fix: recover SOAP requests after Dataverse BCDR redirects

[Suyash Kumar Patel (suyash1208)]

Summary

Dataverse BCDR can redirect the SOAP organization endpoint from the canonical organization host to the same organization's temporary --d host. WCF follows that cross-host redirect but clears the Authorization header, so the temporary host returns 401 and ServiceClient currently treats the request as a terminal failure.

This change uses that final authentication failure as a bounded recovery signal for ExternalTokenManagement connections.

Changes

• Detect the final redirected authority from the HTTP response or WWW-Authenticate challenge.
• Accept only HTTPS transitions between the same organization's canonical and exact --d host, with the same DNS suffix and port and no user information.
• Request a token for the redirected service URI through the existing external token callback.
• Recreate the WCF organization proxy while preserving caller settings, timeout behavior, custom proxy-type assemblies, and request handlers.
• Retry the original request once after the trusted endpoint and token are installed.
• Share the learned endpoint across a root ServiceClient and its clones, including the reverse transition back to canonical when Dataverse redirects it.
• Add focused validation tests and a release-note entry.

Scope and safety

• Recovery is limited to AuthenticationType.ExternalTokenManagement.
• Arbitrary hosts, different organizations, different DNS suffixes, non-HTTPS targets, port changes, user-info URIs, and routing suffixes other than --d are rejected before requesting a token.
• The retry occurs only after the automatically redirected request reaches the trusted target without authorization and receives an authentication failure.

Validation

• 14 focused cross-host redirect tests passed on net8.0.
• Full core unit suite: 52 passed, 27 live-connection tests skipped.
• net462 ServiceClient build succeeded with 0 warnings and 0 errors.