Add linter rule to verify deploymentScripts users aren't passing secure parameters to insecure properties

Similar in concept to the `protect-commandtoexecute-secrets` rule - we should teach users to use secure properties. Otherwise they risk exposing secrets in a way that can be read back from the `deploymentScripts` resource by anyone with `*/read` permissions.

Example of unsafe behavior:
```bicep
@secure()
param foo string

resource asdf 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
name: 'asdf'
location: resourceGroup().location
kind: 'AzurePowerShell'
properties: {
azPowerShellVersion: '3.0'
retentionInterval: 'PT4H'
// this should be flagged - the value of 'foo' can be accessed via a GET.
arguments: '-foo ${foo}'
scriptContent: loadTextContent('myScript.ps1')
}
}
```

Desired approach - use secure env vars:
```bicep
@secure()
param foo string

resource asdf 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
name: 'asdf'
location: resourceGroup().location
kind: 'AzurePowerShell'
properties: {
azPowerShellVersion: '3.0'
retentionInterval: 'PT4H'
scriptContent: loadTextContent('myScript.ps1')
environmentVariables: [
{ name: 'foo', secureValue: foo }
]
}
}
```

Start by finding the existing protect-commandtoexecute-secrets linter rule and the deploymentScripts resource property handling. Use the unsafe and secure examples in this issue to determine which parameter flows should be flagged and which secure environment-variable usage should remain valid; done means the insecure case reports a diagnostic while the desired approach passes.

Written by the indexing model from the issue text.