Flex Consumption: invalid app setting names containing ':' are reported as a misleading FUNCTIONS_WORKER_RUNTIME error

CC: @paulyuk 👀

#### Check for a solution in the Azure portal
N/A - this is a provisioning/validation defect observed when creating a Flex Consumption function app via IaC.

#### Investigative information
- Timestamp: 2026-08-03 (UTC)
- Function App version: Flex Consumption (Linux, `dotnet-isolated`, runtime 10.0)
- Region: westus
- Reproduction is IaC-driven (Terraform azurerm), not runtime-invocation related, so no Invocation ID applies.

#### Repro steps
1. Create a Flex Consumption function app (Linux, `dotnet-isolated`) with app settings whose **names contain `:`**, e.g.:
- `MongoDb:ConnectionString=...`
- `ServiceBus:ConnectionString=...`
- `AzureOpenAI:DeploymentName=...`
2. Create/update the app (Terraform `azurerm_function_app_flex_consumption`, ARM, or portal).

#### Expected behavior
The error should name the offending setting and explain the rule. The Functions app-settings docs say both `:` and `__` are reserved delimiters in setting names, and only `__` is supported cross-platform. So `ServiceBus:ConnectionString` should be rejected with a message that identifies that key and points at the `__` convention.

#### Actual behavior
The create/update is rejected with `400 BadRequest`, but the first error reported does **not** name the offending setting. Observed messages:
- `"The following app setting (Site.SiteConfig.AppSettings.FUNCTIONS_WORKER_RUNTIME) for Flex Consumption sites is invalid. Please remove or rename it before retrying."` — misleading, since `FUNCTIONS_WORKER_RUNTIME` was not set as a user app setting at all (Flex derives it from the runtime config).
- Only after removing the misleading red herring does the real error surface: `"AppSetting with name ServiceBus:ConnectionString is not allowed."`

Because Azure appears to validate the settings batch and report a single error, a genuinely invalid `:`-named key is masked by an unrelated `FUNCTIONS_WORKER_RUNTIME` message, sending users down the wrong debugging path.

#### Known workarounds
Use double-underscore separators (`ServiceBus__ConnectionString`, `AzureOpenAI__DeploymentName`). The .NET configuration provider maps `__` to `:` at runtime, so code reads `config["ServiceBus:ConnectionString"]` unchanged. This is documented under "App setting considerations" in the app-settings reference.

#### Related
- https://learn.microsoft.com/en-us/azure/azure-functions/functions-app-settings
- https://github.com/Azure/azure-functions-core-tools/issues/4645 (FUNCTIONS_WORKER_RUNTIME on Flex - tooling side)

#### Suggested improvement
Report **all** invalid setting names in the batch (or at least surface `:`-containing keys explicitly, e.g. "app setting name \u2018X\u2019 contains a reserved character \u2018:\u2019; use \u2018__\u2019 instead").

Start by reproducing the Flex Consumption create/update through Terraform azurerm, ARM, or the portal with a colon-containing app-setting name, then trace the validation behavior described in the issue. Done means the response identifies the offending setting and explains using __ instead of :, without masking it with the unrelated FUNCTIONS_WORKER_RUNTIME error.

Written by the indexing model from the issue text.