Make sure url placeholders are not treated as valid urls

We have several url placeholders that may be valid urls. This is a problematic pattern. All url placeholders should have special decorations indicating it's a placeholder, such as brackets wrapping around the segments that needs to by dynamically filled by the agent. Plain urls,
such as https://github.com/microsoft/GitHub-Copilot-for-Azure/blob/d01826fce9dc4139dc52230338a1808ab74bbc86/plugin/skills/entra-app-registration/references/BICEP-EXAMPLE.bicep#L177

may increase the chance of the agent treating it as a valid url and send a request to it. This may lead to prompt injection attacks or even credential exfilteration if the request includes credentials.

Search the repository for plain URL placeholders, beginning with plugin/skills/entra-app-registration/references/BICEP-EXAMPLE.bicep around line 177. Confirm each placeholder is visibly delimited so it cannot be treated as a literal URL, then validate the affected references and any available checks.

Written by the indexing model from the issue text.