Have better error message when Insert Resource fails if you're not logged in - or prompt for log in

**Is your feature request related to a problem? Please describe.**
Insert Resource may result in a difficult to interpret error message:

```
Caught exception fetching resource: The access token is from the wrong issuer 'https://sts.windows.net/xxx-yyy-zzzz/'. It must match the tenant 'https://sts.windows.net/xxx-yyy-zzzz/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/xxx-yyy-zzzz' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later. Status: 401 (Unauthorized) ErrorCode: InvalidAuthenticationTokenTenant Content: {"error":{"code":"InvalidAuthenticationTokenTenant","message":"The access token is from the wrong issuer 'https://sts.windows.net/xxx-yyy-zzzz/'. It must match the tenant 'https://sts.windows.net/xxx-yyy-zzzz/' associa...

```

**Describe the solution you'd like**
Would it be possible to either

1. Have a better error message that indicates that bicep could not get to the sub via one of the three login processes (az cli, powershell or VSCode ext) and an indication on how to log in
2. Have a better error message and a prompt to login via one of the supported methods. It also might be possible to prompt for all three, and then set a bicepconfig.json for the appropriate response.

Start by tracing the Insert Resource flow and how it obtains access through Azure CLI, PowerShell, or the VSCode extension. Define a clearer unauthenticated or tenant-mismatch outcome, with login guidance or a supported prompt, and verify that the resulting behavior distinguishes authentication failures from other resource-fetch errors.

Written by the indexing model from the issue text.