fix: surface Entra ID token endpoint errors in fetchToken

Previously a non-2xx response from the token endpoint was silently
parsed into an empty token, producing a misleading 'token response did
not contain an id_token' error. Return the status code and error body
instead.

Signed-off-by: Mathias Mikkel Neerup <mane@tv2.dk>

providers/ms_entra_id.go

@@ -348,6 +348,14 @@ func (p *MicrosoftEntraIDProvider) fetchToken(ctx context.Context, params url.Va
 		SetHeader("Content-Type", "application/x-www-form-urlencoded").
 		Do()
 
+	if err := resp.Error(); err != nil {
+		return nil, fmt.Errorf("token request failed: %v", err)
+	}
+
+	if resp.StatusCode() < 200 || resp.StatusCode() >= 300 {
+		return nil, fmt.Errorf("token request returned %d: %s", resp.StatusCode(), string(resp.Body()))
+	}
+
 	var token *oauth2.Token
 	var rawResponse interface{}