Document that non-Encryption SDK exceptions can be raised

The API documentation for the Python Encryption SDK lists [custom exception types](https://aws-encryption-sdk-python.readthedocs.io/en/latest/generated/aws_encryption_sdk.exceptions.html), but the APIs may let through exceptions from underlying libraries (e.g. `InvalidTag` and `InvalidSignature`) from pyca/cryptography. We should add a note to the documentation stating this.

Alternatively (or additionally) we can try to wrap these kind of exceptions into Encryption SDK custom exceptions with additional context.

Start with the API documentation for the Python Encryption SDK and the generated exceptions page linked in the issue; check how custom exception types are currently described. Done means the documentation clearly notes that underlying cryptography exceptions such as InvalidTag and InvalidSignature may propagate, unless the project chooses the alternative of wrapping them.

Written by the indexing model from the issue text.