Support Microsoft Entra ID authentication for Redis session storage

[Eernie]

Problem

Our Azure Managed Redis has access-key authentication disabled by (org) policy, leaving Microsoft Entra ID as the only auth method. The Redis session storage (storage.session.redis) only supports static username/password, so the Nuts node currently cannot connect to such instances at all. Entra ID auth requires acquiring a token and periodically
re-issuing AUTH before it expires, which a static password config can't do.

Suggested solution

The node already uses github.com/redis/go-redis/v9, which supports a StreamingCredentialsProvider on its Options. Redis provides an official implementation for Entra ID: go-redis-entraid (managed identity, service principal, DefaultAzureCredential), which handles
token refresh automatically.

Rough shape, analogous to the existing AWS RDS IAM support (storage/rds_iam.go):

storage:
  session:
    redis:
      address: rediss://mycache.region.redis.azure.net:10000
      entraid:
        enabled: true
        clientid: "..." # optional, for user-assigned managed identity

When enabled, set opts.StreamingCredentialsProvider instead of username/password.

[reinkrul]

As we already support managed identity for Azure Key Vault, I don't see why we shouldn't extend it to Azure Redis. As it'd be a new future though, earliest release would be v6.3, which isn't scheduled yet. How pressing is this for you?

[Eernie]

Thanks for the support.

To give a bit more context on our setup: we are currently using Redis cache with access keys. However, as Microsoft transitions to Azure Managed Redis (AMR), and due to our company security policies, we won't be allowed to use access keys anymore.

Since Azure Cache for Redis is reaching End-of-Life in 2028, having support for AMR and keyless authentication available by early 2028 would give us the runway we need to plan and execute the migration smoothly.

Thanks again for looking into this, let us know if we can help test or provide feedback when the time comes!