Enable "secrets do not leave Azure keyvaults" policy and functionality across the board

One of the biggest challenges for deployment task is secret protection, especially with passwords. Currently setting AAD app reg secret looks like this

`New-AzADAppCredential -ApplicationId "$applicationID" -Password $graphclientsecret.SecretValue -EndDate (Get-Date).AddYears(2)
`
This mean that secret retrieved from Azure to admin workstation and then sent back to Azure. This situation should only be available when specifically used in cmdlets like Get-AzKeyVaultSecret or in portal.azure.com.

Simple solution to that is to implement syntaxes like this:
`New-AzADAppCredential -ApplicationId "$applicationID" -PasswordReference $referenceToKeyVaultasWithAppSettings -EndDate (Get-Date).AddYears(2)
`

Technical implementation is already there for app services. You just need to apply it everywhere: az PowerShell module and az CLI across all secret parameters.

More examples:
```
Update-AzADUser -UserPrincipalName $smtpusername.SecretValueText `
-Password $smtpuserpassword.SecretValue `
-ForceChangePasswordNextLogin `
-ErrorAction Stop | Out-Null

```
Could look like this
```
Update-AzADUser -UserPrincipalName $smtpusername.SecretValueText `
-PasswordReference $referenceToKeyVaultasWithAppSettings `
-ForceChangePasswordNextLogin `
-ErrorAction Stop | Out-Null
```

Maybe it would be possible that any parameter az CLI and az PowerShell module could accept references to keyvault if solution authors consider it to be sensitive.