ARM template KeyVault reference "id" does not support "resourceId" function

It is inconvenient that you cannot use the `resourceId()` function because it can derive the subscription/resource group name being deployed to for you.

This does not work

``` javascript
"reference": {
"keyVault": {
"id": "[resourceId('Microsoft.KeyVault/vaults','test-kv')]"
},
"secretName": "admin-password"
}
```

If you try to do this, you get the below error

```
New-AzureRmResourceGroupDeployment : 1:19:17 PM - Resource Microsoft.Resources/deployments
'deployment_20160527-124400' failed with message 'The resource identifier of
the KeyVault parameter 'adminPassword' is invalid. Please specify the value following 'subscriptions/{s
ubscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{vaultName}'
format. See http://aka.ms/arm-keyvault for usage details.'
```

Can you add support for this? If it doesn't make sense to put function calls in a parameter file, an alternative might be something like this:

``` javascript
"reference": {
"keyVault": {
"subscriptionName": "Visual Studio Enterprise",
"resourceGroupName": "test-rg",
"vaultName": "test-kv"
},
"secretName": "admin-password"
}
```

Where subscription name and resource group name are optional (defaults to subscription/resource group deployment is deploying to)

No files or tests are named. Start by locating the ARM template KeyVault reference validation and reviewing how the `reference.keyVault.id` value is parsed. Done means supporting the requested `resourceId()` form, or documenting and implementing the proposed subscription, resource-group, and vault-name alternative with deployment coverage.

Written by the indexing model from the issue text.