Add key-vault-certificate-create template

[msmbaldwin]

New RBAC-enabled template for creating a key vault and self-signed certificate.

Template details

• Creates a key vault with enableRbacAuthorization: true
• Creates a self-signed certificate with configurable subject name and validity period
• API version: 2023-07-01
• Includes: bicep, ARM JSON, parameters, metadata, README

This template is referenced by the Key Vault certificates ARM quickstart.

Part of a series to modernize Key Vault quickstart templates to RBAC.

[azure-quickstarts]

@msmbaldwin - check this PR for updates that may be needed to documentation that references this sample. [This is an automated message. You are receiving it because you are listed as the docOwner in metadata.json.]

[azure-quickstarts]

@msmbaldwin - check this PR for updates that may be needed to documentation that references this sample. [This is an automated message. You are receiving it because you are listed as the docOwner in metadata.json.]

[azure-quickstarts]

@msmbaldwin - check this PR for updates that may be needed to documentation that references this sample. [This is an automated message. You are receiving it because you are listed as the docOwner in metadata.json.]

[msmbaldwin]

Pushed a fix in 82c5c94. The MAC pipeline failure was a deployment failure: Microsoft.KeyVault/vaults/certificates is not a valid ARM resource type (Bicep was warning BCP081, which I had suppressed). The vault deployed but the certificate sub-resource returned BadRequest.

Replaced the inline certificate resource with the public Bicep registry module br/public:deployment-scripts/create-kv-certificate:3.4.2, which provisions a user-assigned managed identity, grants it Key Vault Certificate Officer on the vault, and runs az keyvault certificate create via a deployment script. Same approach as deployment-script-azcli-agw-certificates.

Re-running CI now.

[azure-quickstarts]

@msmbaldwin - check this PR for updates that may be needed to documentation that references this sample. [This is an automated message. You are receiving it because you are listed as the docOwner in metadata.json.]

[azure-quickstarts]

@msmbaldwin - check this PR for updates that may be needed to documentation that references this sample. [This is an automated message. You are receiving it because you are listed as the docOwner in metadata.json.]

[msmbaldwin]

MAC fix landed in b2a99de. The deployment-script module wraps each output in createArray(), so I needed [0][0] (not [0]) to get the string out of the array-of-arrays for certificateSecretIds and certificateThumbprintHexs. Build 186903 passed.

The remaining "Validate" Action failure is the GH Actions / MAC schema conflict that's already biting other recent PRs (#14717, #14719 merged with the same red Validate check) — Validate requires testResult in metadata.json, but the MAC schema rejects it.

[msmbaldwin]

#sign-off

MAC is green. The red "Validate" check is the known testResult schema conflict — Validate requires the field, the MAC schema rejects it. Same situation under which #14717 and #14719 were recently merged.

[azure-quickstarts]

@msmbaldwin - check this PR for updates that may be needed to documentation that references this sample. [This is an automated message. You are receiving it because you are listed as the docOwner in metadata.json.]

[alex-frankel]

Old-rules compliant; AzQuickStarts-MAC passed. Net-new key-vault-certificate-create sample (Bicep + README + metadata, +133/-0).