Feature Request

Follow-up to: #25056

Background

Tody the identity binding mode in workload identity is controlled only via environment variables defined in:

In addition, the Azure Federated Token for workload identity is currently only read from a file on disk:

This makes the behavior hard to configure from code and hard to integrate into libiraries that already have their own configuration and/or use non-file token sources.

Request

1. Add a configuration option to set the identity binding proxy from code with explicit options taking precedence over env vars.
2. Keep env-var behavior as the default when the option is not set.
3. For workload identity, allow callers to provide a GetFederatedToken style override so that the token can come from non-file sources (e.g., token from request in csi scenario), while preserving the current file-based behavior as the default.