[Key Vault] Document challenge authentication flow (expected 401s)

[mccoyp]

We mention that challenge 401s are expected in our troubleshooting guide, but not in READMEs or reference documentation (to my knowledge). This means that users aren't informed about this expected behavior until they recognize it as a perceived issue. We've had multiple customer issues raised because of this; most recently #31228.

We should document that 401s are expected at the start of communication in documentation that a user would read before using the library. The details of challenge authentication are too complex to dig into in a README, but we can at the very least mention that an error response is expected at the start of some interactions.