[Bug]: installApps secret placeholder works when embedded in URL, but not when secret contains the full URL

AL-Go version

9.0

Describe the issue

installApps / installTestApps support secret substitution when the secret placeholder is used inside a URL string, but not when the secret value is the entire URL.

This seems inconsistent with the AL-Go release notes, which say a GitHub secret specification can be used “as part of or as the full URL” for apps to install.

Expected behavior

I expected both of these forms to work:

"installApps": [
"https://host/path/file.app?${{SECRETNAME}}"
]

and

"installApps": [
"${{SECRETNAME}}"
]

when the secret value is the full secure URL.

Steps to reproduce

In settings.json, this did not work:

"installApps": [
"${{URITEST}}"
]

Where URITEST contains the full Azure Blob SAS URL to the .app file.

The workflow log shows it being treated as a local path:

Downloading dependencies from settings (installApps and installTestApps)
Processing installApps entry: ${{URITEST}}
Warning: No files found at local path: ${{URITEST}}

However, this did work where URISECRET only includes the sas token:

"installApps": [
"https://x.blob.core.windows.net/x/x.app?${{URISECRET}}"
]

Additional context (logs, screenshots, etc.)

No response

Start with settings.json and the dependency-processing path that logs “Downloading dependencies from settings (installApps and installTestApps).” Trace how installApps entries are classified before download, then verify that a secret resolving to a complete Azure Blob URL is handled like the embedded-secret form while local paths still work.