git-clone task doesn't honor Key Vault PAT

When using the git-clone task the pat parameter expects the actual PAT and not the Key Vault Secret Identifier as described in the blog post here: https://techcommunity.microsoft.com/blog/azuredevcommunityblog/accelerate-developer-onboarding-with-the-configuration-as-code-customization-in-/4062416

To Reproduce
Create a template with a task to perform a git-clone

• name: git-clone
  description: Clone this repository into z:\workspaces
  parameters:
  repositoryUrl: https://github.com/myOrg/SomeRepo.git
  directory: z:\workspaces
  pat: https://not-a-real.vault.azure.net/secrets/GitHubPAT/abc123blahblahblah

Use this template as the customization file when creating a new Dev Box.

Expected behavior
The git-clone process should get the PAT from the key vault using the identity of the Dev Center Project managed identity

Dev Box VM Details (please complete the following information):

• OS version: Windows 11
• Image: microsoftvisualstudio_visualstudioplustools_vs-2022-ent-general-win11-m365-gen2

Additional context
Key Vault exists and is not protected by a firewall.
Dev Center and Project managed identities given RBAC roles to Key Vault

When providing the actual PAT as the value of the parameter, the git-clone works without issue.

Start by tracing the git-clone task's handling of the pat parameter in a Dev Box customization template, then reproduce the example with the Key Vault Secret Identifier and the project managed identity. Compare that behavior with supplying the actual PAT; done means the task retrieves the PAT from Key Vault while preserving the working direct-PAT case.