Application Gateway cmdlets support for Trusted Root Certificates in Key Vault

## Description of the new feature

Application Gateway supports configuration of Trusted Root Certificates and SSL certificates by linking to a Key Vault item. In the REST API, this is exposed in a `keyVaultSecretId` property inside the [ApplicationGatewayTrustedRootCertificate](https://docs.microsoft.com/en-us/rest/api/application-gateway/applicationgateways/get#applicationgatewaytrustedrootcertificate) object, similarly to the [ApplicationGatewaySslCertificate](https://docs.microsoft.com/en-us/rest/api/application-gateway/applicationgateways/get#applicationgatewaysslcertificate) object.

The Az.Network module cmdlets support Key Vault references for Application Gateway SSL certificates, but not for Trusted Root Certificates (there is no `KeyVaultSecretId` property in the [PSApplicationGatewayTrustedRootCertificate class](https://github.com/Azure/azure-powershell/blob/ebfd682c96ee327a368cb488f6538812d910bd16/src/Network/Network/Models/PSApplicationGatewayTrustedRootCertificate.cs), like there is in the [PSApplicationGatewaySslCertificate class](https://github.com/Azure/azure-powershell/blob/ebfd682c96ee327a368cb488f6538812d910bd16/src/Network/Network/Models/PSApplicationGatewaySslCertificate.cs)). As a consequence, given an existing Application Gateway configured to load a Trusted Root Certificate from a Key Vault, updating that gateway using Az.Network cmdlets breaks the Trusted Root Certificate configuration (because the `keyVaultSecretId` property does not round-trip during the `Get-AzApplicationGateway`/modify/`Set-AzApplicationGateway` cycle).

## Proposed implementation details (optional)

The implementation could probably be similar to how `KeyVaultSecretId` is handled for Application Gateway SSL certificates.

Start with src/Network/Network/Models/PSApplicationGatewayTrustedRootCertificate.cs and compare it with PSApplicationGatewaySslCertificate.cs, especially the existing KeyVaultSecretId handling. Trace the Application Gateway Get/modify/Set cmdlet path and its tests, if present. Done means a Trusted Root Certificate Key Vault reference survives that round trip without being dropped.

Written by the indexing model from the issue text.