Refactor validation rule architecture (separate files, multiple diagnostics, lazy preprocessing) #7116

Context

Follow-up from PR #7053 review. Parent tracking issue: #7112

PR Conversations

• Allow rules to return slice of diagnostics (tg-msft, Victor Vazquez (@vhvb1989))
• Pull rules into separate file/folder (tg-msft)
• Role assignment analysis should be per-rule (tg-msft)
• Do not preprocess globally (tg-msft)

What needs to change

1. Multiple diagnostics: Allow validation functions to return a slice of results so expensive analysis can produce multiple findings per rule.
2. Separate files: Move validation rule implementations out of bicep_provider.go into their own files (possibly a nested folder) to keep BicepProvider clean.
3. Lazy preprocessing: Move role assignment analysis and similar preprocessing into the individual rules that need them instead of doing it globally. Consider an annotation/caching pattern (HasRoleAssignments(resource) caching results in annotations map).
4. Revisit after adding more rules to validate the approach.

Files to update

• cli/azd/pkg/infra/provisioning/bicep/bicep_provider.go
• cli/azd/pkg/infra/provisioning/bicep/local_preflight.go