KeyResolver requires extra "get" permissions

[pakrym]

It seems that IKeyEncryptionKeyResolver.Resolve can be implemented in a way that avoids requiring "get" permission on key.

Azure.RequestFailedException: 
Status: 403 (Forbidden)

Content:
{"error":{"code":"Forbidden","message":"Operation is not allowed.\r\nOperation: \"get\"\r\nCaller: appid=bdc40a9a-30bd-47f0-8e10-8033e8e1c248;oid=2bc41755-ddc3-4b49-a381-7428fa1537d5;numgroups=0;iss=https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/\r\nVault: bdorrans;location=eastus","innererror":{"code":"ForbiddenByPolicy"}}}

Headers:
Cache-Control: no-cache
Pragma: no-cache
Server: Microsoft-IIS/10.0
x-ms-keyvault-region: eastus
x-ms-request-id: de919011-b86f-4004-8878-4bcf9b263c10
x-ms-keyvault-service-version: 1.1.0.898
x-ms-keyvault-network-info: addr=23.99.191.39;act_addr_fam=InterNetwork;
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000;includeSubDomains
X-Content-Type-Options: nosniff
Date: Fri, 24 Apr 2020 16:29:00 GMT
Content-Length: 340
Content-Type: application/json; charset=utf-8
Expires: -1

   at Azure.Security.KeyVault.Keys.Cryptography.KeyResolver.ParseResponse[T](Response response, T result)
   at Azure.Security.KeyVault.Keys.Cryptography.KeyResolver.GetKeyAsync(Uri keyId, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.Keys.Cryptography.KeyResolver.ResolveAsync(Uri keyId, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.Keys.Cryptography.KeyResolver.Azure.Core.Cryptography.IKeyEncryptionKeyResolver.ResolveAsync(String keyId, CancellationToken cancellationToken)

cc @heaths @schaabs

[schaabs]

azure-sdk-for-net/sdk/keyvault/Azure.Security.KeyVault.Keys/src/Cryptography/KeyResolver.cs

Lines 112 to 127 in 648e09c

	try
	{
	Argument.AssertNotNull(keyId, nameof(keyId));
	KeyVaultKey key = await GetKeyAsync(keyId, cancellationToken).ConfigureAwait(false);
	KeyVaultPipeline pipeline = new KeyVaultPipeline(keyId, _apiVersion, _pipeline, _clientDiagnostics);
	return (key != null) ? new CryptographyClient(key, pipeline) : new CryptographyClient(keyId, pipeline);
	}
	catch (Exception e)
	{
	scope.Failed(e);
	throw;
	}

Looks like Resolve and ResolveAsync expect GetKey and GetKeyAsync to return null when they fail rather than raising an exception. We should be able to wrap GetKey and GetKeyAsync in a try/catch to handle failures and return null.

[heaths]

Rather than use exceptions for control flow, might be better to handle these in a manner I did for certificate LROs (non-throwing, delegating whether to throw to code further down the stack).