Update README.md to clarify authentication instructions

[adhilto]

🗣 Description

• Update the section headers to clarify that OAuth and service accounts are parallel paths
• Add note that service account instructions only apply if not using OAuth credential

💭 Motivation and context

The instructions as it was before could have been more clear (see #291).

🧪 Testing

N/A

✅ Pre-approval checklist

• [x] This PR has an informative and human-readable title.
• [x] Changes are limited to a single goal - eschew scope creep!
• [x] If applicable, All future TODOs are captured in issues, which are referenced in the PR description.
• [x] The relevant issues PR resolves are linked preferably via closing keywords.
• [x] All relevant type-of-change labels have been added.
• [x] I have read and agree to the CONTRIBUTING.md document.
• [x] These code changes follow cisagov code standards.
• [x] All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
• [x] Tests have been added and/or modified to cover the changes in this PR.
• [x] All new and existing tests pass.

✅ Pre-merge Checklist

• [ ] This PR has been smoke tested to ensure main is in a functional state when this PR is merged.
• [ ] Squash all commits into one PR level commit using the Squash and merge button.

✅ Post-merge Checklist

• [ ] Delete the branch to clean up.
• [ ] Close issues resolved by this PR if the closing keywords did not activate.

[adhilto]

Looks great to me.

Small nitpick, I may switch the two lines to have the "hey don't use this unless.." first instead of second, but that's small enough and a matter of personal preference.

I think I like it more the way it is, and since you don't feel too strongly about it, I'm going to leave it as is.