Prefer WorkloadIdentity over ClientSecret in dev

Reorder AllowedAuthMethods so cloud dev exercises the federated
WorkloadIdentityCredential first, with ClientSecretCredential retained
as fallback during the cutover.

Author: Christdej

api/appsettings.Development.json

@@ -2,7 +2,7 @@
   "AzureAd": {
     "ClientId": "dd7e115a-037e-4846-99c4-07561158a9cd",
     "ClientSecret": "",
-    "AllowedAuthMethods": [ "ClientSecret", "WorkloadIdentity" ]
+    "AllowedAuthMethods": [ "WorkloadIdentity", "ClientSecret" ]
   },
   "Logging": {
     "LogLevel": {