SOPS AZKV getDefaultAzureCredential Logic Guards are Missing

[apeschel]

https://github.com/fluxcd/kustomize-controller/blob/main/internal/sops/azkv/keysource.go#L216

Based on the comments to this function. It seems like the intention is to have three different options for auth within this function, and use logic guards to gate which option is actually used.

However, the envCred block has no guards, and instead will fall through to the subsequent methods on failure.

This is problematic, because it will hide any issues in the case where someone wants to use envCred based auth, but there is a legitimate failure in the envCred auth process. Rather than fail and print the reason for the failure, the logic will just fall through to the other methods and will result in a completely unrelated and misleading error being printed.

It seems like the logic in the comment is a bit confused as well, since this doesn't make sense as written:

azidentity.NewEnvironmentCredential if environment variables AZURE_CLIENT_ID, AZURE_CLIENT_ID is set

[kingdonb]

This should be fixed in #838 (which will be released with Flux 2.0.0-rc.2)