Locking and unlocking published artifacts

**Is your feature request related to a problem? Please describe.**
I would like to be able to lock my published artifacts in an ACR to avoid accidental overwrite. This would be useful for CI/CD scenarios where a latest/stable artifact is depended on and you have more strict processes for updating artifacts with certain tags.

**Describe the solution you'd like**
It would be great to either:

1. have an option on the `bicep publish` command such as `--immutable` that allows you to lock the published artifact. The thing to consider here is that we wouldn't have any clear way to unlock the artifact again if needed.
2. create a new command to handle the different locking options (read, write, list, delete) of published artifacts. This might be outside the scope of Bicep though, since there are other CLIs that do this.

This is related to https://github.com/Azure/bicep/issues/4757 which started discussions on an `--immutable` option.

Start with the `bicep publish` command and the discussion in issue 4757. Compare the proposed `--immutable` option with a separate command supporting read, write, list, and delete locking operations for published ACR artifacts. Done requires a decided scope and a clear way to lock and, where supported, unlock artifacts without accidental overwrites.

Written by the indexing model from the issue text.