Securely pass token from client to bot via token service

[xieofxie]

This PR provides an alternative way and more secure way to pass a client token to bot application via token service, instead of the current demo approach which directly sends the token as a channel event.

Clients now leverage a SAS feature in token service to create a short-lived SAS session to set the token into and token service will forward that to bot.

No changes required for bot application. This doesn't change when and where bot is waiting for the token. This only impacts the path from client to bot.
 

Fixes #

Changelog Entry

Description

Design

Specific Changes

-

• I have added tests and executed them locally
• I have updated CHANGELOG.md
• I have updated documentation

Review Checklist

This section is for contributors to review your work.

• Accessibility reviewed (tab order, content readability, alt text, color contrast)
• Browser and platform compatibilities reviewed
• CSS styles reviewed (minimal rules, no z-index)
• Documents reviewed (docs, samples, live demo)
• Internationalization reviewed (strings, unit formatting)
• package.json and package-lock.json reviewed
• Security reviewed (no data URIs, check for nonce leak)
• Tests reviewed (coverage, legitimacy)