Update OnBeforeTokenAcquisitionForOnBehalfOf event to construct ClaimsPricipal from token

src/Microsoft.Identity.Web.TokenAcquisition/TokenAcquisition.cs

@@ -1255,7 +1255,23 @@ private void NotifyCertificateSelection(
                     {
                         if (addInOptions != null)
                         {
-                            await addInOptions.InvokeOnBeforeTokenAcquisitionForOnBehalfOfAsync(builder, tokenAcquisitionOptions, userHint!).ConfigureAwait(false);
+                            ClaimsPrincipal? principalToUse;
+
+                            // Create ClaimsPrincipal from the token if available, otherwise pass null
+                            if (!string.IsNullOrEmpty(tokenUsedToCallTheWebApi))
+                            {
+                                var handler = new JwtSecurityTokenHandler();
+                                var jwtToken = handler.ReadJwtToken(tokenUsedToCallTheWebApi);
+                                var identity = new CaseSensitiveClaimsIdentity(jwtToken.Claims);
+                                identity.BootstrapContext = tokenUsedToCallTheWebApi;
+                                principalToUse = new ClaimsPrincipal(identity);
+                            }
+                            else
+                            {
+                                principalToUse = null;
+                            }
+
+                            await addInOptions.InvokeOnBeforeTokenAcquisitionForOnBehalfOfAsync(builder, tokenAcquisitionOptions, principalToUse!).ConfigureAwait(false);
                         }
 
                         AddFmiPathForSignedAssertionIfNeeded(tokenAcquisitionOptions, builder);