docs: add authenticated silo connection sample

[ReubenBond]

Note

Depends on #10496. The sample uses the connection-authentication APIs and Entra provider introduced there, so its snippet and sample builds cannot pass against main until that prerequisite lands.

Adds a maintained sample and host documentation for securing silo-to-silo connections with mutual TLS and Microsoft Entra workload identities. The guidance covers certificate and token validation, cluster-scoped authorization, enforcement rollout and rollback, token expiry, and operational monitoring, and registers the sample in the docs navigation and sample gallery.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

Adds a new maintained sample and accompanying hosting documentation for securing Orleans silo-to-silo connections using mutual TLS (mTLS) plus Microsoft Entra workload identity authentication, and wires the sample into the docs navigation and sample gallery.

Changes:

• Adds the AuthenticatedSiloConnections sample project (options/config validation, TLS policy, Entra configuration, OpenTelemetry + structured logging).
• Registers the sample in Samples.slnx, samples/README.md, and samples/gallery.json.
• Adds a new hosting doc page + snippet project, and links it from the docs TOC and TLS doc.

Show a summary per file

File	Description
samples/Samples.slnx	Adds the new sample project to the samples solution.
samples/README.md	Adds the sample to the samples list/table.
samples/gallery.json	Registers the sample in the sample gallery manifest.
samples/AuthenticatedSiloConnections/SiloAuthentication.cs	Implements TLS + Entra configuration and certificate pinning helper policy.
samples/AuthenticatedSiloConnections/SampleOptions.cs	Adds strongly-typed configuration binding + validation for the sample.
samples/AuthenticatedSiloConnections/README.md	Provides setup and operational guidance for running the sample.
samples/AuthenticatedSiloConnections/Program.cs	Bootstraps the sample host (logging, OTEL metrics, Orleans, credential + cert loading).
samples/AuthenticatedSiloConnections/AuthenticatedSiloConnections.csproj	New sample project file + dependencies.
samples/AuthenticatedSiloConnections/appsettings.json	Default config template with placeholders for required values.
docs/site/src/content/docs/tutorials-and-samples/index.md	Adds the sample to the docs “Tutorials and samples” index.
docs/site/src/content/docs/toc.yml	Adds a new “Authenticated silo connections” entry under Hosting.
docs/site/src/content/docs/host/transport-layer-security.md	Cross-links TLS docs to the new authenticated connections doc.
docs/site/src/content/docs/host/snippets/authenticated-silo-connections/csharp/AuthenticatedSiloConnections.Snippets.csproj	Adds a snippet build project linking the sample code into docs snippets.
docs/site/src/content/docs/host/authenticated-silo-connections.md	New end-to-end how-to guidance for silo connection authentication and rollout/monitoring.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 14/14 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

Review details

Suppressed comments (2)

samples/AuthenticatedSiloConnections/Program.cs:29

• The OpenTelemetry resource uses Environment.MachineName as the serviceInstanceId, but this sample is intended to run two silo processes on the same machine. That results in identical resource attributes for both instances, making metrics/log correlation ambiguous in collectors/backends which key on service.name + service.instance.id.

    .ConfigureResource(resource => resource.AddService(
        serviceName: "authenticated-orleans-silo",
        serviceInstanceId: Environment.MachineName))

samples/AuthenticatedSiloConnections/SiloAuthentication.cs:86

• SHA-256 certificate fingerprints are commonly formatted with spaces (in addition to colons). The current normalization only removes ':', so valid fingerprints like "AA BB ..." will fail parsing even though they represent the same bytes.

            var normalized = value.Replace(":", "", StringComparison.Ordinal);

• Files reviewed: 14/14 changed files
• Comments generated: 0 new
• Review effort level: Lite

[ReubenBond]

CI investigation found two PR-caused failures on the previous head: the authenticated sample did not have its required sample-level Directory.Packages.props, and the documentation snippet referenced the Entra source project even though that dependency was absent from the branch. I rebased/stacked this branch onto #10496 at 0e7041615, where the corrected standalone package references, package versions, and snippet dependency are present. The SQL Server net8.0 failure was unrelated infrastructure behavior: seven tests failed after the SQL Server container began returning Login failed for user 'sa'; this PR does not modify ADO.NET code. The branch update has triggered fresh CI runs.

[Copilot]

Review details

• Files reviewed: 66/66 changed files
• Comments generated: 2
• Review effort level: Lite

[ReubenBond]

Closing as an exact duplicate of #10496: both PRs currently point to commit 0e70416 and contain the same 66-file change. The authenticated-connection sample and guidance remain in #10496.