[Key Vault] Add preview support for AD FS challenge parsing

[mccoyp]

As an at-least-temporary solution for #28648, we should offer preview support for proper AD FS challenge authentication via Key Vault SDK parsing.

Most likely, this would be a check to see if the tenant ID we parse from a challenge response is "adfs" (or anything that's not a GUID). If this is the case, we should skip providing a tenant ID to our token request to avoid the error described in the linked issue.

[mccoyp]

What the Azure CLI does for handling AD FS authorities, for reference: https://github.com/Azure/azure-cli/blob/eedd4dc63e0cef6e5aed60340cdaeb63c935f0a6/src/azure-cli-core/azure/cli/core/auth/identity.py#L333-L350

def _get_authority_url(authority_endpoint, tenant):
    """Convert authority endpoint (active_directory) to MSAL authority:
        - AAD: https://login.microsoftonline.com/your_tenant
        - ADFS: https://adfs.redmond.azurestack.corp.microsoft.com/adfs
    For ADFS, tenant is discarded.
    """

    # Some Azure Stack (bellevue)'s metadata returns
    #   "loginEndpoint": "https://login.microsoftonline.com/"
    # Normalize it by removing the trailing /, so that authority_url won't become
    # "https://login.microsoftonline.com//tenant_id".
    authority_endpoint = authority_endpoint.rstrip('/').lower()
    is_adfs = authority_endpoint.endswith('adfs')
    if is_adfs:
        authority_url = authority_endpoint
    else:
        authority_url = '{}/{}'.format(authority_endpoint, tenant or "organizations")
    return authority_url, is_adfs