Support managed Bitwarden secrets from resource outputs

[sliekens]

Related proposal: #1591

Let a resource output supply a managed Bitwarden secret while preserving AddSecret(name) and ParameterResource inheritance.

Providers prepare the inherited parameter value. The existing writer reads that value and creates or updates the destination. Explicit parameter configuration overrides a reference expression. Without an override, each reconciliation resolves the expression again. Generated values do not become saved input overrides, and failed producers cannot use an old destination value.

Prerequisite: microsoft/aspire#18108 is required for the clean implementation. This draft uses Aspire internals to test the contract on 13.5. Replace that access with the public parameter APIs when available. Keep the lifecycle and persistence tests.

This PR is open for design review. The linked feature proposal still needs maintainer approval.

Validation

• 90 Bitwarden tests pass after rebasing onto current main.
• The implementation also passed the 90-test suite against Aspire 13.5.1 before the rebase.
• Coverage includes parameter processing, explicit overrides, prefill, repeated reconciliation, cancellation, missing outputs, pure publish, and producer-to-writer pipeline ordering.
• Local application validation confirmed secret provisioning and dependent service startup.
• Repository-wide formatting still reports baseline diagnostics. A clean full-repository format check is not claimed.

PR checklist

• Feature branch in a fork, based on current main.
• No merge commits in the feature changes.
• Tests and integration documentation updated.
• Existing parameter inheritance and convenience calls preserved.
• Complete upstream prerequisite and replace private parameter-state access.
• Maintainer review of API compatibility, XML documentation, and style conventions.