redis: add credentials provider option and built-in Entra ID auth

[cosmin-staicu]

Adds support for rotated Redis credentials to GetRedisClient, through a vendor-neutral WithStreamingCredentialsProvider option and a config-driven azure_entra flag for Microsoft Entra ID. Existing callers and YAML are unaffected.

Why

GetRedisClient only accepts a static Username/Password. That doesn't work with managed Redis offerings that authenticate with short-lived identity tokens. Azure Managed Redis and Redis Enterprise Cloud issue Microsoft Entra ID tokens that expire after about an hour and have to be refreshed and re-AUTH'd on the live connection before they lapse.

With static credentials, a long-running deployment is disconnected when the token expires. The pub/sub bus is hit hardest. Managed Redis evicts a pub/sub connection when its token expires, and under RESP2 a pub/sub socket can't process an out-of-band AUTH, so it has to reconnect with a fresh token. Every component that builds its client through this package (server, sip, egress, ingress) is affected.

What

go-redis has supported this through StreamingCredentialsProvider since v9.6 (this module is on v9.22.0), and Redis publishes an official Entra ID provider, go-redis-entraid. This PR exposes it two ways:

• WithStreamingCredentialsProvider(p), a variadic option on GetRedisClient for callers that bring their own provider.
• RedisConfig.azure_entra, a YAML flag that builds a go-redis-entraid provider from the ambient Azure identity (DefaultAzureCredential), so a deployment can turn it on in config without a call site of its own.

An explicit provider takes precedence over the flag. With neither set, the client is built exactly as before. Building the options moved into buildRedisOptions, so it can be tested without a Redis server.

go.mod gains go-redis-entraid, with azidentity and MSAL as indirect dependencies.

Tests in redis/redis_test.go cover a client with no provider, an explicit provider, the flag, and an explicit provider winning over the flag.

[changeset-bot]

🦋 Changeset detected

Latest commit: 25c44a2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
github.com/livekit/protocol	Patch
@livekit/protocol	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[CLAassistant]

All committers have signed the CLA.

[cosmin-staicu]

Rebased onto current main (was conflicting) and split: this PR is now the redis commit alone, with a changeset added.

The log-config-watch work that had crept onto this branch has moved to #1791, which is stacked on this one.