Add comment explaining why we are doing this

Signed-off-by: Derek Ho <dxho@amazon.com>

src/main/java/org/opensearch/security/auth/BackendRegistry.java

@@ -304,6 +304,7 @@ public boolean authenticate(final SecurityRequestChannel request) {
                 if (authDomain.isChallenge()) {
                     final Optional<SecurityResponse> restResponse = httpAuthenticator.reRequestAuthentication(request, null);
                     if (restResponse.isPresent()) {
+                        // saml will always hit this to re-request authentication
                         if (!authDomain.getHttpAuthenticator().getType().equals(SAML_TYPE)) {
                             auditLog.logFailedLogin("<NONE>", false, null, request);
                         }