persist: migrate to the new Azure SDK crates

Replaces the MaterializeInc-fork azure_core/azure_identity/
azure_storage/azure_storage_blobs 0.21 with upstream azure_core 0.35.0,
azure_identity 0.35.0, and azure_storage_blob 0.12.0 from crates.io.
The fork (MaterializeInc/azure-sdk-for-rust) is no longer referenced.

API migration in src/persist/src/azure.rs:

- `ContainerClient` -> `BlobContainerClient`
- `blob_client.get().into_stream()` -> `blob.download(None)` with
  `AsyncResponseBody` streaming
- `blob.put_block_blob(value)` -> `blob.upload(value.into(), None)`
  (using the `From<Bytes>` trait impl; the inherent `from(Vec<u8>)`
  shadows it)
- `blob.get_properties()` / `blob.delete()` take `None` options
- list_blobs pager yields `BlobItem`s directly via `try_next()`
- `create_default_credential()` is gone; chain
  `WorkloadIdentityCredential` (k8s production) with
  `DeveloperToolsCredential` (local CLI) as the closest equivalent.
  Managed Identity is not in the chain — add explicitly if needed.
- SAS tokens are now passed via URL query string, with
  `credential = None`.
- `Error::as_http_error().status()` -> `Error::http_status()`.

Custom `reqwest::Client` is plumbed through `TransportOptions::new`
to apply `BlobKnobs` per-attempt / read / connect timeouts, and the
client explicitly selects `tls_backend_rustls()` so Azure traffic
runs on rustls + aws-lc-rs ahead of the workspace-wide HTTP-clients
migration.

Azurite emulator support is stubbed out in this commit: the new SDK
dropped its built-in Azurite path, and `new_for_test` returns `None`
so Azurite-dependent tests skip. The next commit restores coverage by
implementing Azure Shared Key signing as a per-try `Policy`.

`deny.toml` updates:

- `rustls` ban narrowed to `hyper-rustls`, `reqwest`,
  `rustls-platform-verifier`, `tokio-rustls` wrappers so the Azure
  rustls chain is allowed; the ban still blocks other crates from
  picking up rustls before the HTTP-clients migration lands.
- `log` wrappers: add `jni` and `rustls-platform-verifier` (new
  transitive deps via the rustls chain); drop `azure_svc_blobstorage`
  (gone with the fork).
- Skip list: 9 duplicate-version pairs introduced while the rustls
  and native-tls stacks coexist. They collapse once the workspace
  finishes migrating to rustls.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jasonhernandez