Add rules for Bicep code creation

[shahdk]

No description provided.

[rocklambros]

Review Summary

Thanks for this contribution, @shahdk! Azure Bicep is a valuable addition to the IaC coverage. The security content is technically sound and follows our Do/Don't/Why/Refs pattern well.

Requesting two additions to align with our CONTRIBUTING.md guidelines, plus one small fix in README.md.

---

1. Add Prerequisites Section (Required)

Per our framework template, rule sets should link to foundational rules. Please add this section after the intro paragraph in rules/iac/bicep/CLAUDE.md:

## Prerequisites

Before applying these rules, ensure familiarity with:

- [Core IaC Security Principles](../_core/iac-security.md) - Foundation for all infrastructure code
- [OWASP Top 10 2025](../../_core/owasp-2025.md) - Web application security fundamentals

---

2. Add Quick Reference Table (Required)

Per CONTRIBUTING.md, every rule set needs a Quick Reference table at the end. Please add before the Summary section:

## Quick Reference

| Rule | Level | CWE/Standard |
|------|-------|--------------|
| Secure Parameter Handling | strict | CWE-798, CWE-532 |
| Key Vault Security Configuration | strict | CWE-311 |
| Storage Account Security | strict | CWE-319, CWE-311 |
| SQL Database Security | strict | CWE-306, CWE-284 |
| Network Security Groups | strict | CWE-284, CWE-923 |
| Managed Identity Usage | strict | CWE-798 |
| Resource Locks | strict | NIST CP-9 |
| Diagnostic Settings | strict | CWE-778 |
| Azure Policy Compliance | strict | NIST CM-7 |
| Module Security | strict | CWE-829 |
| Private Endpoints | strict | CWE-923 |
| Automated Security Validation | strict | NIST SA-11 |

---

3. Fix README.md Tree Syntax

The directory tree has a formatting issue. Change:

│   │   └── pulumi/CLAUDE.md       # Pulumi (secrets, CrossGuard, ESC)
│   │   └── bicep/CLAUDE.md        # Azure Bicep

To:

│   │   ├── pulumi/CLAUDE.md       # Pulumi (secrets, CrossGuard, ESC)
│   │   └── bicep/CLAUDE.md        # Azure Bicep (secrets, authentication, network isolation)

---

What Looks Good

• All 12 rules follow the Do/Don't/Why/Refs pattern correctly
• Enforcement levels are appropriate (strict for credential/encryption issues)
• Code examples are production-quality and copy-paste ready
• References include CWE, Azure Security Baseline, CIS Azure, and NIST 800-53
• CI/CD validation section (Rule 12) is thorough

Once these additions are made, I'll approve the PR. Welcome to the project!