feat: use form_post for default flow

[rzhao271]

Settings Sync auth verification: passed

[Copilot]

Pull request overview

This PR switches the Microsoft authentication extension's default interactive sign-in flow to use the OAuth 2.0 form_post response mode, so the authorization code is delivered in a POST body rather than the redirect URL's query string. To make this possible, it bumps @azure/msal-node (and its transitive msal-common / msal-node-extensions) to versions that added built-in loopback-client support for form_post (msal-node 5.4.0, via upstream MSAL PR #8694). Delivering the code in a POST body avoids exposing it in the browser URL, improving the security posture of the local sign-in flow.

Changes:

• Pass responseMode: 'form_post' in DefaultLoopbackFlow.trigger's acquireTokenInteractive request (correctly scoped to the built-in loopback flow only; UrlHandlerFlow still reads query params and is left unchanged).
• Update package-lock.json to @azure/msal-node@5.4.0, @azure/msal-node-extensions@5.3.2, and @azure/msal-common@16.11.1, all satisfying the existing ^5.1.5 range in package.json.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
extensions/microsoft-authentication/src/node/flows.ts	Adds responseMode: 'form_post' to the default loopback interactive auth request.
extensions/microsoft-authentication/package-lock.json	Bumps MSAL dependencies to versions providing form_post loopback support.

Files not reviewed (1)

• extensions/microsoft-authentication/package-lock.json: Generated file