BearerTokenPolicy handles CAE claims challenges by default

[chlowell]

This adds CAE support for all clients lacking a custom challenge handler i.e., everyone except Key Vault and Storage. The policy will request CAE tokens by default, however whether it receives them and claims challenges is up to RP and tenant configuration. With this change, CAE will just work by default when enabled by RP and tenant. To avoid opting clients like Key Vault and Storage in to receiving challenges they can't handle, I added a SupportsCAE option to AuthorizationHandler to control whether the policy requests CAE tokens when given a custom challenge handler.

[jhendrixMSFT]

Was there a specific trigger prompting this to be moved to the common bearer token policy, or was it just a matter of "it's baked enough"?

[chlowell]

It's baked enough, there's a common implementation for RPs we can target. I see they now document how to handle multiple challenges, so let me update our logic to follow that guidance.

[chlowell]

Moving this back to draft because I believe the core policy can handle CAE challenges even when the client has provided a custom challenge handler, at the cost of some more complexity. That could enable CAE support for e.g. Key Vault without any change to client code.