Passing tokens in interactive BWAs

[guardrex]

Addresses #31691
Addresses #35225

The obvious approach to take for the base use case of getting tokens for web API calls is via use of a token handler (DelegatingHandler) attached to the HttpClient with AddHttpMessageHandler in the server project. This will work regardless of render mode and in concert with the CookieOidcRefresher of OIDC sample apps and in concert with MS Identity Web API/packages (including the Downstream API package).

This PR also brings the security node articles for our sample apps up to speed with the changes that I made over on the samples repo ...

• Those apps now have web API in external projects.
• We're pushing devs to create separate registrations for apps and web APIs.

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/blazor/call-web-api.md	aspnetcore/blazor/call-web-api
aspnetcore/blazor/components/httpcontext.md	aspnetcore/blazor/components/httpcontext
aspnetcore/blazor/fundamentals/index.md	aspnetcore/blazor/fundamentals/index
aspnetcore/blazor/security/additional-scenarios.md	aspnetcore/blazor/security/additional-scenarios
aspnetcore/blazor/security/blazor-web-app-with-entra.md	aspnetcore/blazor/security/blazor-web-app-with-entra
aspnetcore/blazor/security/blazor-web-app-with-oidc.md	aspnetcore/blazor/security/blazor-web-app-with-oidc