Add a supported non interactive CLI for provisioning BYOK model secrets into VS Code SecretStorage

IT administrators need to deploy BYOK language model configurations across managed workstations using PowerShell or similar tooling. Model metadata can be deployed through chatLanguageModels.json, but securely provisioning the referenced API key currently requires each user to interact with the VS Code UI.

Unlike environment variable expansion proposed in #322545 we do not want secrets stored in environment variables command line arguments, configuration files, or deployment logs.

Please provide a supported, non interactive CLI or administrative API that creates, updates, and removes language model secrets using the same SecretStorage backend as VS Code UI.

For example:
```ps1
Get-SecretFromApprovedSource |
code --set-language-model-secret "cloudflare-ai-gateway/apiKey" --stdin
```
The interface should:

Accept secrets through stdin or another non logging channel, never a command line argument
Produce stable secret references usable from chatLanguageModels.json
Return automation friendly exit codes
Document the Windows, macOS, and Linux storage guarantees and fallbacks, complementing #213903.

This would let organizations retrieve credentials from an approved enterprise vault and securely configure Copilot/BYOK models without manual user interaction or plaintext credentials on managed workstations.

---

Example enterprise use case

An administrator deploys the following chatLanguageModels.json configuration:
```json
[
{
"name": "Cloudflare AI Gateway",
"vendor": "customendpoint",
"apiKey": "${input:chat.lm.secret.CLOUDFLARE_API_TOKEN}",
"apiType": "chat-completions",
"models": [
{
"id": "moonshotai/kimi-k3",
"name": "Kimi K3",
"url": "https://api.cloudflare.com/client/v4/accounts//ai/v1/chat/completions",
"toolCalling": true,
"vision": true,
"thinking": true,
"maxInputTokens": 950000,
"maxOutputTokens": 32000,
"requestHeaders": {
"cf-aig-gateway-id": ""
}
}
]
}
]
```
Here, `CLOUDFLARE_API_TOKEN` is a stable secret identifier. The configuration contains no API-token value and VS Code resolves the identifier through its secure SecretStorage backend.

A proposed administrative command could provision that secret non interactively:
```ps1
Get-SecretFromApprovedSource |
code --set-language-model-secret "CLOUDFLARE_API_TOKEN" --stdin

if ($LASTEXITCODE -ne 0) {
throw "Failed to provision the VS Code language-model secret."
}
```

The command name is illustrative.