[patch][eng]: Update submodule to latest version

[juan-arias]

PR Checklist (must be completed before review)

• All tests pass locally
• PR size is <= 500 LOC per PR Size Check policy
• PR is independently mergeable (no hidden dependencies)
• Appropriate reviewers are assigned
• PR reviewed by code owner (required if Copilot-generated)
• SME or Senior IC assigned where required

Proposed changes

This pull request updates the MSAL/IdentityCore submodule to a newer commit. This change brings in the latest updates from the IdentityCore dependency, which may include bug fixes, improvements, or new features.

Type of change

• Feature work
• Bug fix
• Documentation
• Engineering change
• Test
• Logging/Telemetry

Risk

• High – Errors could cause MAJOR regression of many scenarios. (Example: new large features or high level infrastructure changes)
• Medium – Errors could cause regression of 1 or more scenarios. (Example: somewhat complex bug fixes, small new features)
• Small – No issues are expected. (Example: Very small bug fixes, string changes, or configuration settings changes)

Additional information

[azure-pipelines]

This pull request does not update CHANGELOG.md.

Please consider if this change would be noticeable to a partner or user and either update CHANGELOG.md or resolve this conversation.

[Copilot]

Pull request overview

This PR updates the MSAL/IdentityCore git submodule pointer to bring in a newer revision of the IdentityCore dependency (AzureAD/microsoft-authentication-library-common-for-objc), updating what code MSAL consumes from the shared common library.

Changes:

• Bump MSAL/IdentityCore submodule from 6c4d155c98bfc0553482e6684ebdc16a86201314 to aca95b2137d26f21cc36bbd1d144a1ee60671571.

[kaisong1990]

This range also ships MSIDBoundTokenProvider, but acquireBoundTokenWithRequest: only returns metadata JSON with error == nil; it never redeems or obtains a token. The silent-routing follow-up is still open (CommonCore #1875), and interactive acquisition remains stubbed, so a OneAuth caller can treat an unusable non-token payload as successful authentication. Please keep this provider out of the MSAL pointer, gate it, or return an explicit unsupported error until the real flow lands.

[kaisong1990]

aca95b2 is only on jarias/mobile-onboarding-in-progress-session-fixes; it is not an ancestor of CommonCore dev, which also explains the failing submodule policy check. Merging this would pin MSAL to an unmerged feature-branch commit that can become orphaned and is outside the approved dependency line. Please land the CommonCore changes first, then repoint this gitlink to the resulting dev commit.