Context

Follow-up from PR #7053 review. Parent tracking issue: #7112

PR Conversations

• Allow rules to return slice of diagnostics (@tg-msft, @vhvb1989)
• Pull rules into separate file/folder (@tg-msft)
• Role assignment analysis should be per-rule (@tg-msft)
• Do not preprocess globally (@tg-msft)

What needs to change

1. Multiple diagnostics: Allow validation functions to return a slice of results so expensive analysis can produce multiple findings per rule.
2. Separate files: Move validation rule implementations out of bicep_provider.go into their own files (possibly a nested folder) to keep BicepProvider clean.
3. Lazy preprocessing: Move role assignment analysis and similar preprocessing into the individual rules that need them instead of doing it globally. Consider an annotation/caching pattern (HasRoleAssignments(resource) caching results in annotations map).
4. Revisit after adding more rules to validate the approach.

Files to update

• cli/azd/pkg/infra/provisioning/bicep/bicep_provider.go
• cli/azd/pkg/infra/provisioning/bicep/local_preflight.go