Refactor validation rule architecture (separate files, multiple diagnostics, lazy preprocessing)

## Context
Follow-up from [PR #7053](https://github.com/Azure/azure-dev/pull/7053) review. Parent tracking issue: #7112

## PR Conversations
- [Allow rules to return slice of diagnostics](https://github.com/Azure/azure-dev/pull/7053#discussion_r2926690629) (@tg-msft, @vhvb1989)
- [Pull rules into separate file/folder](https://github.com/Azure/azure-dev/pull/7053#discussion_r2928021952) (@tg-msft)
- [Role assignment analysis should be per-rule](https://github.com/Azure/azure-dev/pull/7053#discussion_r2928031828) (@tg-msft)
- [Do not preprocess globally](https://github.com/Azure/azure-dev/pull/7053#discussion_r2928180945) (@tg-msft)

## What needs to change
1. **Multiple diagnostics**: Allow validation functions to return a slice of results so expensive analysis can produce multiple findings per rule.
2. **Separate files**: Move validation rule implementations out of `bicep_provider.go` into their own files (possibly a nested folder) to keep `BicepProvider` clean.
3. **Lazy preprocessing**: Move role assignment analysis and similar preprocessing into the individual rules that need them instead of doing it globally. Consider an annotation/caching pattern (`HasRoleAssignments(resource)` caching results in annotations map).
4. Revisit after adding more rules to validate the approach.

## Files to update
- `cli/azd/pkg/infra/provisioning/bicep/bicep_provider.go`
- `cli/azd/pkg/infra/provisioning/bicep/local_preflight.go`