Migration guide: `azure_security_keyvault_certificates` (from azure_security_keyvault)

Part of #4228

## Migration guide: `azure_security_keyvault_certificates`

### Official Crate

- **Name:** [`azure_security_keyvault_certificates`](https://crates.io/crates/azure_security_keyvault_certificates)
- **Current version:** 0.12.0
- **Service:** Azure Key Vault Certificates

### Unofficial Predecessor(s)

| Predecessor | Version(s) | Relationship | crates.io |
|---|---|---|---|
| `azure_security_keyvault` v0.1.0–0.21.0 | Era 2 (2022–2024) | **Different crate** — era 2 monolith covering secrets, keys, and certificates; split into 3 dedicated crates in era 3 | [crates.io](https://crates.io/crates/azure_security_keyvault) |

### Migration Guide Should Cover

- The Key Vault crate split (same context as secrets/keys guides)
- Poller-based certificate creation flow (long-running operation)
- Dedicated certificate lifecycle management
- Certificate policy configuration
- Challenge-based authentication for sovereign clouds
- Cargo.toml dependency changes

### Acceptance Criteria

- [ ] Migration guide published in repo docs (e.g., `docs/migration/azure_security_keyvault_certificates.md`)
- [ ] Code samples for key scenarios: creating a certificates client, create/get/delete/list certificates, certificate policies, polling for certificate creation
- [ ] FAQ section covering common migration pitfalls (especially the crate split and Poller pattern)
- [ ] Linked from the `azure_security_keyvault_certificates` crate README
- [ ] Reviewed by SDK team

Start with the related secrets and keys migration guides and the azure_security_keyvault_certificates crate README. Document the crate split, dependency changes, certificate lifecycle, policies, Poller-based creation, and sovereign-cloud authentication with samples and an FAQ. Done means the guide is published at docs/migration/azure_security_keyvault_certificates.md, linked from the README, and ready for SDK team review.

Written by the indexing model from the issue text.