Allow --azure-kv to encrypt using latest version of key without providing the version

Allow passing an Azure Key Vault key URL without a version, e.g. https://my-az-kv.vault.azure.net/keys/key-name

Today SOPS forces specifying /{version}, which creates churn on key rotation.

Azure return latest version if only key-name is requested.