CVE-2026-42151: Prometheus Azure AD remote write OAuth client secret exposed via config API

Users who use Azure AD remote write with OAuth authentication are impacted.

The client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.