Add cloud instance name validation

[alexholub113]

Added optional check to prevent using keys that are shared across multiple clouds.

• Added a new extension method EnableEntraIdSigningKeyCloudInstanceNameValidation that adds additional validation to the IssuerSigningKeyValidatorUsingConfiguration delegate call chain.
• New validation checks that the cloud instance name of the openid-configuration matches the cloud instance name of the signing key.
• New exception SecurityTokenInvalidCloudInstanceException is thrown in case check is failed.

Resolves #2832

[brentschmaltz]

Suggest the name: SecurityTokenInvalidCloudInstanceException (drop the 'Name') as there may be other reasons in the future.

@GeoK not sure about the need to inherit from SecurityTokenInvalidSigningKeyException, perhaps SecurityTokenException

[alexholub113]

Renamed class.
in my opinion SecurityTokenInvalidCloudInstanceNameException is still SecurityTokenInvalidSigningKeyException but more specific

[GeoK]

Discussed this with Brent offline - it is ok as-is.