Improve validation and completions with `additionalProperties`

**Is your feature request related to a problem? Please describe.**
* We should offer property access completions for the "additional" properties that have actually been specified in the resource declaration.
* Property access on an "additional" property that isn't specified in the resource declaration should produce a warning. (Can't be an error because RPs can violate the RPC and return a modified set of properties.)

```bicep
resource bp 'Microsoft.Blueprint/blueprintAssignments@2018-11-01-preview' = {
name: 't'
location: resourceGroup().location
identity: {
type: 'None'
}
properties: {
parameters: {
'foo': {
reference: {
keyVault: {
id: 's'
}
secretName: 's'
}
}
}
resourceGroups: {
'bar': {
name: 's'
location: 's'
}
}
}
}

// no name completions
var test = bp.properties.resourceGroups.|

// prop. access completions work at `|` but no warning on "blah"
var test2 = bp.properties.resourceGroups.blah.
```

This originally was discovered during #3084

Read the related issue #3084 and reproduce the two Bicep examples in this issue. Trace how resource property completions and unknown-property diagnostics are produced for additionalProperties. Done means specified additional properties appear in completions, unspecified access produces a warning rather than an error, and the examples behave as described.

Written by the indexing model from the issue text.