azd env set-secret should allow setting the actual secret value, not just a reference

## Problem

`azd env set-secret ` sounds like it sets a secret value, but it actually creates a **reference** (a pointer) to an existing Key Vault secret. It does not set or update the secret's actual value.

When a user has a new secret (e.g. a freshly rotated OAuth client secret from a provider) and runs `azd env set-secret MY_SECRET`, the expected behavior is that azd prompts for the value and stores it. Instead, the command prompts to select an existing Key Vault secret and saves a reference to it. If the existing KV secret is stale, the user ends up with a reference to the old value and no obvious way to update it through azd.

## Expected behavior

`azd env set-secret ` should let the user **set the actual secret value**, matching what the command name describes. At minimum, the first prompt ("Select how you want to set...") should include a clear option like "Enter a new value" that writes the value to Key Vault (or prompts for a vault + secret name and writes it there).

## Current behavior

1. Run `azd env set-secret MY_SECRET -e myenv`
2. Prompted: "Select how you want to set MY_SECRET" with options like "Select an existing Key Vault secret"
3. Walk through tenant, subscription, vault, and secret selection
4. Result: a KV **reference** is saved in the azd environment, but the underlying secret value is unchanged

To actually update the secret value, the user must separately run `az keyvault secret set --vault-name --name --value `, which is not discoverable from the `azd env set-secret` flow.

## Suggestion

Add an option in the `set-secret` flow to provide a new value (securely prompted, never echoed) and write it to the selected Key Vault secret. This closes the loop: one command to both set the value and save the reference.

Alternatively, if `set-secret` is intentionally reference-only, consider renaming to `set-secret-ref` or `link-secret` so the name matches the behavior, and add a separate `azd env set-secret-value` command (or document the `az keyvault secret set` step prominently in the success message).