CSP Invalid controller defaults to Unknown unless is certain of a credential failure

[ehvs]

Which issue this PR addresses:

https://issues.redhat.com/browse/ARO-22432

Test plan for issue:

• Unit tests
• e2e
• Operator local tests

Is there any documentation that needs to be updated for this PR?

Indirectly updated the testing steps for ARO Operator:
#4496

How do you know this will function as expected in production?

By changing the azure-credentials secret in kube-system , upon the operator Reconciliation the state was set to ServicePrincipalInvalid

Attempted credentials:
  ClientSecretCredential authentication failed.

  POST https://login.microsoftonline.com/[redacted]/oauth2/v2.0/token
  --------------------------------------------------------------------------------
  RESPONSE 400: 400 Bad Request
  --------------------------------------------------------------------------------
  {
    "error": "unauthorized_client",
    "error_description": "AADSTS700016: Application with identifier '[redacted]' was not found in the directory '[redacted]. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. Trace ID: Correlation ID: Timestamp: 2025-12-02 09:11:24Z",
    "error_codes": [
      700016
    ],
    "timestamp": "2025-12-02 09:11:24Z",
    "trace_id": "xxx",
    "correlation_id": "xxx",
    "error_uri": "https://login.microsoftonline.com/error?code=700016"
  }
  --------------------------------------------------------------------------------
  To troubleshoot, visit https://aka.ms/azsdk/go/identity/troubleshoot#client-secret

reason: Service Principal invalid
status: "False"
type: ServicePrincipalValid

When the error was not a known error. it sets to Unknown

    status: Unknown
    type: ServicePrincipalValid

[kimorris27]

Looks good! I left two small, non-blocking suggestions.

[mociarain]

LGTM