cloud: address RUSTSEC-2026-0275 in the legacy Azure SDK dependency

Development Task

TiKV currently depends on the legacy Azure SDK for Rust 0.18 release line. That release line is affected by RUSTSEC-2026-0275: authenticated Azure requests can write the live Authorization header value to logs when Debug or Trace logging is enabled.

The advisory now also causes cargo deny to fail in TiKV presubmit jobs. For example, both pull-clippy-linux-arm64 and the preflight stage of pull-unit-test failed on #20008 before Clippy or unit tests reached this PR's code.

Current dependency scope

components/cloud/azure/Cargo.toml uses the 0.18 generation of:

• azure_core
• azure_identity
• azure_security_keyvault
• azure_storage
• azure_storage_blobs

These dependencies serve both Azure Blob Storage and Azure Key Vault / Managed HSM paths. Upgrading only the direct azure_core dependency is insufficient because the other legacy SDK crates continue to resolve azure_core 0.18.

Required outcome

TiKV must prevent Azure request credentials from being written to logs while preserving the existing Azure Blob Storage, Identity, Key Vault, and Managed HSM behavior. The resolution must also give cargo deny enough evidence to accept the dependency state.

Candidate approaches

• Migrate the complete Azure component to a compatible, supported Azure SDK release set whose resolved azure_core version is not affected.
• Patch the legacy SDK's header formatting and pin TiKV to an audited revision.
• Prevent the affected SDK from emitting credential-bearing Debug/Trace request logs, backed by regression tests and a documented temporary deny.toml exception.

The implementation should be selected after evaluating API migration cost, Azure logging requirements, OpenSSL/FIPS compatibility, and the maintenance cost of carrying a patched dependency. An unconditional advisory exception is not sufficient because TiKV redirects Rust log records into its configured logger and supports Debug/Trace logging.

Acceptance criteria

• Debug/Trace logging is verified not to expose Bearer tokens, SharedKey signatures, or SAS credentials.
• cargo deny check advisories passes with either a non-affected dependency or a documented exception backed by the implemented mitigation and a clear removal condition.
• Existing Azure Blob and KMS unit tests pass.
• The resolution preserves SharedKey, SAS, service-principal, managed/default identity, client-certificate, Blob encryption, Key Vault, and Managed HSM behavior.
• The affected Azure paths receive focused integration or live-environment smoke validation appropriate to the selected implementation.

References

• RustSec advisory: https://rustsec.org/advisories/RUSTSEC-2026-0275.html
• Upstream report: https://github.com/Azure/azure-sdk-for-rust/issues/5074
• CI occurrence: https://github.com/tikv/tikv/pull/20008