Update `SecretsInParamsMustBeSecureRule` to check declared properties of parameters

**Is your feature request related to a problem? Please describe.**
[`SecretsInParamsMustBeSecureRule`](https://github.com/Azure/bicep/blob/main/src/Bicep.Core/Analyzers/Linter/Rules/SecretsInParamsMustBeSecureRule.cs) currently checks whether a parameter has a name that implies it should be `@secure()`. This check is not performed on declared properties of parameters using user-defined types:

```bicep
param password string // <-- will be caught by linter

param authConfig {
password: string // <-- will NOT be caught by linter
}```

**Describe the solution you'd like**
The analyzer should visit all declared properties within the declared type of a parameter, checking each for names that we associate with sensitive values.

Start with src/Bicep.Core/Analyzers/Linter/Rules/SecretsInParamsMustBeSecureRule.cs and trace how it checks parameter names and declared user-defined types. Verify the analyzer visits declared properties such as authConfig.password and reports sensitive names that lack @secure(), while preserving the existing top-level parameter check.

Written by the indexing model from the issue text.