ACR Auth - Respond with www-authenticate header to the token endpoint upon a 401

Currently an incorrect basic token responds as follows

```
➜ curl -v https://PAT:banana@dependabottest.azurecr.io/v2/ 2>&1 | grep -i www
< Access-Control-Expose-Headers: WWW-Authenticate
< Www-Authenticate: Basic realm="Azure Container Registry"
```
As for other registries that support bearer, nudging the user to send the creds or authenticate with the bearer endpoint is desirable and ACR could return the Bearer header so that clients may follow that path.

This pattern is shown here -
https://github.com/dependabot/dependabot-core/issues/3689

```
curl -v https://PAT:bananas@registry.hub.docker.com/v2/library/golang/tags/list 2>&1 | grep -i www
< www-authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:library/golang:pull"
```