Allow expressions in getSecret function

[levimatheri]

Description

This pull request introduces enhanced support for the az.getSecret function in Bicep parameter files, allowing both compile-time constant and expression-based arguments for Key Vault secret retrieval. The changes update the function overloads, expression handling, and test coverage to ensure that parameter files correctly generate Key Vault references, including scenarios with external inputs. The most important changes are grouped below by theme.

Important:
If string literal types are used for the getSecret function, then emit KV reference as before (i.e. not using resourceId() function. This prevents breaking people since the Deployments API will reject expressions in secret references below api-version 2025-04-01

Key Vault Secret Retrieval Improvements

• Updated the az.getSecret function overload to accept both string literals and expressions for parameters, removing the compile-time constant restriction and supporting dynamic external inputs.
• Changed the ParameterKeyVaultReferenceExpression to use Expression objects for KeyVaultId, SecretName, and SecretVersion, allowing more flexible and dynamic expression handling.

JSON Emission and Transformation

• Updated the ParametersJsonWriter to emit Key Vault references using EmitPropertyWithTransform, enabling transformation of expressions (such as external inputs) when generating parameter files.

---

Example Usage

param vmPassword = getSecret(
  externalInput('subId'), 
  externalInput('rgName'), 
  externalInput('kvName'), 
  externalInput('secretName'), 
  externalInput('secretVersion'))

Checklist

• I have read and adhere to the contribution guide.

Microsoft Reviewers: Open in CodeFlow

[github-actions]

Test this change out locally with the following install scripts (Action run 24260318214)

VSCode

• Mac/Linux

  bash <(curl -Ls https://aka.ms/bicep/nightly-vsix.sh) --run-id 24260318214

• Windows

  iex "& { $(irm https://aka.ms/bicep/nightly-vsix.ps1) } -RunId 24260318214"

Azure CLI

• Mac/Linux

  bash <(curl -Ls https://aka.ms/bicep/nightly-cli.sh) --run-id 24260318214

• Windows

  iex "& { $(irm https://aka.ms/bicep/nightly-cli.ps1) } -RunId 24260318214"