Distinguish credential unavailability from failure

[chlowell]

This adds CredentialUnavailableError to indicate a credential didn't attempt to authenticate because it lacks required data or state. For example, EnvironmentCredential raises it when environment configuration is incomplete, and SharedTokenCacheCredential raises it when the shared cache isn't present. Credentials previously raised ClientAuthenticationError in such cases. That exception now indicates a credential attempted to authenticate but failed due to an unexpected error.

ChainedTokenCredential (and DefaultAzureCredential) uses this to make authentication more predictable. When one of its credentials raises, ChainedTokenCredential only tries the next credential when the raised exception is CredentialUnavailableError. This prevents unexpected authentication. For example, if environment variables specify a service principal with an invalid secret, DefaultAzureCredential won't continue on to managed identity after authenticating as that principal fails.

Closes #8166

[bryevdv]

Great tests, only one small suggestion

[xiangyan99]

CredentialUnavailableError needs to be a sub-class of ClientAuthenticationError. Or it will be a breaking change.

[chlowell]

ClientAuthenticationError inherits HttpResponseError, which is misleading as a base here because CredentialUnavailableError is raised when no request was sent.

I agree changing the hierarchy is a larger issue. For this PR I'll have CredentialUnavailableError inherit ClientAuthenticationError, and we can revisit the hierarchy later.

[xiangyan99]

CredentialUnavailableError needs to be a sub-class of ClientAuthenticationError. Or it will be a breaking change.