feat(allowlist): add Bicep (.bicep) support #523

Sub-issue of #470 — Bicep language group.

Scope

• internal/config/allowlist/supported_file_types.json — add .bicep
• internal/config/allowlist/allowed_ext_test.go — test cases
• internal/config/rules/rule_docs/bicep.md — dedicated review rules covering hardcoded secrets/connection strings, missing @secure() on sensitive parameters, overly permissive RBAC assignments, and insecure resource defaults (public network access, missing TLS enforcement)
• internal/config/rules/system_rules.json — map .bicep to the new doc
• internal/config/rules/system_rules_test.go — rule-resolution test case

No test-exclude patterns needed per the tracking issue's own table.

I'll follow up with a PR shortly.