Add tests to guard client-capabilities forwarding

[gladjohn]

Add tests to guard client-capabilities forwarding (no functional change)

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Summary of the changes

• Confirmed that client capabilities are already forwarded by UpdateConfidentialClientApplicationOptionsFromMergedOptions, which calls WithClientCapabilities(...) when the CCA is built.
  Tokens issued today already include the expected xms_cc claim.

• Added a comment to [TokenAcquisition.cs](https://github.com/AzureAD/microsoft-identity-web/compare/gladjohn/cca_capability_idweb?expand=1#diff-3600735102cf2582ea4dc8277f799690b8a8135f4971e0be919fbecd053ae2ca) to clarify that

Changes in this PR

Added test coverage

• CrossCloudFicIntegrationTest_WithCp1 – decodes the JWT and asserts cp1 is present in the xms_cc claim.
• CrossCloudFicUnitTest_WithCp1 – inspects the outbound form data and verifies the claims payload carries cp1.

Outcome

No functional change; behavior is now safeguarded by extra checks to prevent future regressions.

Fixes #3349

[jmprieur]

LGTM
Thanks for improving the CrossCloudFic tests.