Improve the error for nested getSecret() calls in parameter files

[polatengin]

Description

Fixes #19934

ARM supports Key Vault references as complete parameter values. It does not support them inside objects or arrays.

This change detects nested getSecret() calls earlier and reports BCP351 error.

Top-level getSecret() assignments and supported extension configuration assignments continue to work.

I've added tests for getSecret() calls;

• Object properties
• Arrays of objects
• Nested objects and arrays
• Conditional expressions
• Loop expressions
• Namespaced az.getSecret() calls
• Calls that include a secret version

Before the fix, all new tests failed with BCP338, after the fix, they pass and report BCP351 as expected.

The existing parameter-file and extension configuration tests also pass.

Checklist

• I have read and adhere to the contribution guide.

[github-actions]

Test this change out locally with the following install scripts (Action run 29541446351)

VSCode

• Mac/Linux

  bash <(curl -Ls https://aka.ms/bicep/nightly-vsix.sh) --run-id 29541446351

• Windows

  iex "& { $(irm https://aka.ms/bicep/nightly-vsix.ps1) } -RunId 29541446351"

Azure CLI

• Mac/Linux

  bash <(curl -Ls https://aka.ms/bicep/nightly-cli.sh) --run-id 29541446351

• Windows

  iex "& { $(irm https://aka.ms/bicep/nightly-cli.ps1) } -RunId 29541446351"