Support cloud instance name validation

[GeoK]

• Add a new extension method EnableEntraIdSigningKeyCloudInstanceValidation that adds additional validation rule to the IssuerSigningKeyValidatorUsingConfiguration delegate call chain.
• New validation rule checks that the cloud instance name of the openid-configuration matches the cloud instance name of the signing key.
• SecurityTokenInvalidCloudInstanceException (new exception) should be thrown in case check is failed.