Add discovery of unmapped secrets to SecretRotation tool

The secret rotation tool should be able to discover secrets in use that don't participate in a known rotation plan. For example, I can:
1. query Azure DevOps for all service connection types that have "confidential" parameters
2. scan for all defined service connections that use those types/parameters.
3. Compare that list to all configured rotation plans
4. Return the list of ADO serviceConnections that use secrets in parameters, but don't have a plan defined to rotate the secret.

We can do the same for:
- AAD client secrets we or our service accounts own
- ADO and Github PATs on service accounts we own
- SAS tokens we don't recognize issued against storage account keys we do recognize

Start at the SecretRotation tool entry point and inspect how configured rotation plans are represented. Map the requested Azure DevOps service connections, AAD client secrets, service-account PATs, and SAS tokens to their discovery sources. Done means the tool returns in-use secrets that have no configured rotation plan.

Written by the indexing model from the issue text.