Report non-secret external payload store URI on worker handshake

[YunchuWang]

Summary

DTS externalizes large orchestration payloads to Azure Blob Storage, persisting only an opaque token blob:v1:<container>:<blobName> (no storage account) in the backend DB. To let the DTS dashboard render those payloads by reading the blob directly with the signed-in user's own AAD token, the backend needs the worker's non-secret storage account base URI.

The worker already configures the storage account (LargePayloadStorageOptions) and advertises WorkerCapability.LargePayloads on its GetWorkItems handshake. This PR makes the worker also report its non-secret account base URI on that handshake, via a new proto field external_payload_store_uri (field number 12) on GetWorkItemsRequest.

This is an independent feature and is not related to the auto-purge PR #758 — it branches from main and does not contain any auto-purge code.

Changes

1. Proto (src/Grpc/orchestrator_service.proto): add string external_payload_store_uri = 12 to GetWorkItemsRequest. C# stubs are generated at build time by Grpc.Tools (no checked-in stubs), yielding a GetWorkItemsRequest.ExternalPayloadStoreUri property.
2. PayloadStore (abstract base): add virtual Uri? ExternalPayloadStoreBaseUri => null.
3. BlobPayloadStore: override it to return the storage account base URI derived from this.containerClient.Uri using BlobUriBuilder, stripping the container, blob, SAS and query. This never contains a secret/SAS/key — even when configured from a connection string (e.g. https://acct.blob.core.windows.net/, or http://127.0.0.1:10000/devstoreaccount1 for Azurite).
4. GrpcDurableTaskWorkerOptions: add string? ExternalPayloadStoreUri next to Capabilities.
5. AzureBlobPayloads worker registration: in the same PostConfigure that adds WorkerCapability.LargePayloads, set opt.ExternalPayloadStoreUri = store.ExternalPayloadStoreBaseUri?.ToString().
6. GrpcDurableTaskWorker.Processor: send ExternalPayloadStoreUri on the GetWorkItemsRequest handshake.

Tests

Added test/Worker/Grpc.Tests/ExternalPayloadStoreUriTests.cs (that project already references AzureBlobPayloads, keeping the change minimal — no new test project/solution wiring):

• BlobPayloadStore.ExternalPayloadStoreBaseUri returns the account base URI with no query/SAS for a connection-string store (UseDevelopmentStorage=true), a connection-string store with an account key (asserts the key is never leaked), and an AccountUri + credential store.
• The worker-options plumbing sets GrpcDurableTaskWorkerOptions.ExternalPayloadStoreUri from the store.

Validation

• dotnet build Microsoft.DurableTask.sln → 0 errors.
• Worker.Grpc.Tests → 141 passed, 0 failed (137 existing + 4 new).

Compatibility

Adding a new optional proto field is backward-compatible; all existing field numbers are preserved.