Fix propagation of secrets

[SteveL-MSFT]

PR Summary

Looking into the problem, it would seem that the solution is NOT to have secret extensions wrap their output as JSON. Instead, the problem is that the secret extension handler should be wrapping the output of an extension as a secureString and propagate that through the engine. This led to a few fixes to make this work end-to-end:

1. The secret extension tests need to explicitly use showSecrets with the Echo resource
2. The secret.ps1 test extension should ignore errors so that looking for a non-existing secret doesn't report an unnecessary PowerShell error
3. The secret extension handler will now always wrap the raw output of a secret extension as a secureString object
4. Fix parameter handling to differentiate secureString and secureObject from string and object so they are distinct
5. Fix Echo resource to properly unwrap the secureString or secureObject when showSecrets is true

PR Context

Fix #1569

[Copilot]

Pull request overview

This PR updates the secret-extension pipeline so secrets are propagated as secureString (and validated distinctly from string/object) through the DSC engine, and adjusts the Debug/Echo resource and tests to reveal/redact secrets based on showSecrets.

Changes:

• Wrap secret-extension stdout as secureString in the extension handler, and have secret() return that secure JSON value instead of a plaintext string.
• Tighten parameter validation/handling so secureString/secureObject are treated as distinct JSON shapes (not interchangeable with string/object).
• Update Echo and secret-extension Pester tests to use showSecrets and validate expected secret visibility.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
resources/dscecho/src/main.rs	Unwrap/redact secure outputs depending on showSecrets, including array/object handling changes.
lib/dsc-lib/src/functions/secret.rs	Parse extension output as SecureString JSON and return as a JSON value instead of a plain string.
lib/dsc-lib/src/functions/parameters.rs	Validate that secureString/secureObject parameters are in the expected secure JSON format.
lib/dsc-lib/src/extensions/secret.rs	Wrap raw secret extension output as a serialized SecureString JSON object.
lib/dsc-lib/src/configure/mod.rs	Validate parameter types with distinct checks for secureString and secureObject.
lib/dsc-lib/locales/en-us.toml	Add localized error messages for secure-type validation and secret-format failures.
extensions/test/secret/secret.ps1	Adjust test secret extension behavior to suppress errors for missing secrets.
dsc/tests/dsc_extension_secret.tests.ps1	Update secret extension tests to set showSecrets: true and validate unwrapped secret output.

Comments suppressed due to low confidence (1)

lib/dsc-lib/src/functions/secret.rs:9

• secret() now returns a JSON object ({"secureString": ...}), but its function metadata still advertises return_types: [String]. This makes dsc function list/schema outputs misleading for consumers. Update the metadata to report Object as the return type.

use crate::configure::{context::Context, parameters::SecureString};
use crate::extensions::dscextension::Capability;
use crate::functions::{FunctionArgKind, FunctionCategory, FunctionMetadata};
use rust_i18n::t;
use serde_json::Value;