Security Center checks & other static analysis

**Describe the solution you'd like**
I would love to see something similar to [tfsec](https://github.com/aquasecurity/tfsec) for Bicep except linked up with Azure Security Center somehow. There are so many rules that could be running against our IoC instead of after a deployment. It would be super helpful to catch issues before a PR even gets merged.

Start by reviewing tfsec and Azure Security Center to understand the requested static-analysis scope for Bicep. Determine which Security Center checks could run against infrastructure as code before deployment and define how the checks would integrate into pull-request validation; done means an agreed, implementable design rather than a single-file change.

Written by the indexing model from the issue text.