docs: add get key permission requirement for Azure Key Vault when version is omitted

[Hanashiko]

Summary

Fixes #2112

When the key version is omitted from the Azure Key Vault URL (trailing slash), SOPS resolves the latest key version via the Azure Key Vault API. This requires the get key permission in addition to encrypt and decrypt, which was not mentioned in the documentation.

Changes:

• Added get tot he recommended az keyvault set-policy --key-permissions command
• Added a note explaining wht get is needed and the trade-off with explicit versioning

[felixfontein]

Thanks for your contribution! Please note that you must sign-off your commits, otherwise this cannot be merged. Thanks.

[felixfontein]

Suggested change

	.. note::
	.. note::

[felixfontein]

Suggested change

The ``get`` key permission is required when the key version is ommited (i.e the URL ends with a trailing slash). In that case SOPS calls the Azure Key Vault API to resolve the latest key version, which requires the ``get`` permission. If you specifty an explicit key version in the URL you can omit ``get``, but this means you will need to update your configuration every time the key is rotated.

The ``get`` key permission is required when the key version is ommited (for example if the URL ends with a trailing slash). In that case SOPS calls the Azure Key Vault API to resolve the latest key version, which requires the ``get`` permission. If you specifty an explicit key version in the URL you can omit ``get``, but this means you will need to update your configuration every time the key is rotated.

[felixfontein]

CI failures are unrelated, see #2123.