Assertion section in config doc

Summary of the new feature / enhancement

Admins may want to blast out configurations and have it only apply if the config is applicable via assertions. Having it as a dedicated section in the config makes it easy to understand what is being tested and you don't have to declare dependsOn for it as it would always be run first. In this case, if any assertion fails it would stop deployment immediately. One question is whether we need to assert(false) instead of always assuming assert(true).

Proposed technical implementation details (optional)

# assertions would always be processed first
# all asserts must be true otherwise an error is returned
# collect and return all assertions and don't fail on first false
assertions:
  resources:
    - type: Microsoft/OSInfo
      properties:
        family: Windows
    - type: Foo/Bar
      properties:
        hello: world
resources:
  - type: Microsoft.Windows/Registry
    properties:
      keyPath: HKCU/Environment
      _exist: true

The issue names no files, tests, or entry points. Start by locating the configuration schema/parser and deployment validation flow, then determine how assertion resources should be represented and evaluated. Done means assertions run before resources, all failures are reported, and deployment stops when any assertion fails.