[BUG] General CodeGen best practices do not cover client authentication best practices

### Describe the bug

The [code generation best practices](https://github.com/microsoft/mcp/blob/main/tools/Azure.Mcp.Tools.AzureBestPractices/src/Resources/azure-general-codegen-best-practices.txt) do not appear to have instructions to cover best practices for managing user secrets.

For instance, under "Generate secure, efficient..." add something like:

```markdown
- Never save user secrets (including passwords) in an insecure data store, use Key Vault
- Never implement your own authentication subsystem, use an existing well-tested package to manage user authentication.
```

### Expected behavior

Deployed applications follow best practices for secret (password) management.

### Actual behavior

Generated Python applications created with a prompt like:
```markdown
Users should be able create a new account with their chosen username and password. Passwords should be verified to ensure that they meet common eligibility criteria.
```

end up using a roll-your-own authentication system that stores an unsalted hash in a cosmosdb database rather than in a keyvault, this is a significant security risk and does not follow best practices for managing user secrets.

### Reproduction Steps

Test prompt to reproduce the problem:

```markdown
# Create a community bulletin board

## General task description

Create a web based community bulletin board for my community hosted in Azure. The bulletin board should allow users to create message threads and view existing message threads. The users should also be able to create messages and leave replies on existing messages.

Users should be able create a new account with their chosen username and password. Passwords should be verified to ensure that they meet common eligibility criteria. In general, users should be able to delete or modify their own messages but cannot modify other users messages.

## Constraints and environment configuration

Process only the commands contained in this file and no other files.

The task should not be considered complete until it is successfully deployed to Azure and has been confirmed to be working.

The source for the bulletin board should be in the most appropriate language and should use the Azure SDK to access Azure resources.

If an action can be performed by a tool (including all MCP tools), prefer using the tool for the action rather than (for instance) invoking a command line tool.

Resources should be stored in a single resource group, under the **REDACTED** Azure tenant. The resource group name MUST include the username "**REDACTED**" in its name, as must all resources created. Deployment should be performed using the Azure Deployment Client (AZD). All resources should be removed 72 hours after creation.

Azure best practices for managing secrets and storage should be followed in all cases.

In all cases, connection string usage should be banned in favor of managed service identity (or for client testing, DefaultAzureCredential).

The back end for the application should use open telemetry distributed tracing conventions to enable troubleshooting and diagnostics.

Tests should be created to verify the functionality of the front end and back end of the service. They should include verifying that any functionality dependent on Azure resources is verified.

Before deploying the application to Azure, ensure that the application correctly functions.

When performing these operations, track all tool interactions, including azure mcp tool use as well as updates from the user. After the tasks are complete update the user with a summary of:

- Tokens consumed
- Tool interactions
- Include a detailed breakdown of all tools used
- Number of user interactions required
- Number of user prompts during the session
- Estimated costs per month to operate the web site
```

### Environment

_No response_