Create bicep-audit for security best practice validation

[tonybaloney]

This PR adds an extra workflow that is either triggered manually or whenever anyone changes the files in infra/

It scans the templates against the best practice rule list, primarily for security and adds the results to the GitHub Security tab. Exceptions can be fixed or dismissed with reasons.

[adrianhall]

Is there any way we can check out the output prior to adding this into every single check-in? I would like to validate the output prior to accepting.