feat: introduce azd validate command with pipeline and gate framework

[vhvb1989]

Description

Implements the core validation pipeline framework for azd validate (resolves #7817).

Design Overview

The framework introduces three core concepts:

1. Pipeline — Orchestrates sequential execution of validation gates. Supports configurable error behavior (abort on first error vs continue through all gates).

2. Gate — A named validation stage (e.g. local-preflight, project-config). Each gate groups related checks and implements the Gate interface (Name() + Run(ctx, pipelineCtx)).

3. Check — An individual validation function within a gate, identified by a stable RuleID.

Shared Pipeline Context

A PipelineContext flows through all gates, providing:

• Console, Environment, and Project references
• A typed Values map for inter-gate data sharing (e.g. a gate can store computed resource data for downstream gates)

Extension Integration (future)

The design supports two extension contribution models:

• Model A (v1): Extensions add checks to existing gates via lifecycle events — reuses existing EventStream gRPC, no new proto surface needed.
• Model B (v2): Extensions contribute full gates via a new validation-gate capability — requires new gRPC messages, deferred.

Files

File	Purpose
pkg/validate/types.go	Core types: CheckResult, CheckSeverity, GateResult, PipelineResult
pkg/validate/gate.go	Gate interface, PipelineContext with typed value accessors
pkg/validate/check.go	Check, CheckFn, CheckBasedGate (convenience gate from checks)
pkg/validate/pipeline.go	Pipeline engine with abort/continue behavior
pkg/validate/report.go	ValidationReport UX rendering (reuses preflight report pattern)
pkg/validate/gate_project_config.go	Built-in project configuration validation gate
pkg/validate/pipeline_test.go	11 unit tests covering pipeline execution
internal/cmd/validate.go	ValidateAction with --gate filter flag

How existing local-preflight becomes a gate

The existing localArmPreflight in the bicep provider maps directly to a Gate implementation. In a follow-up PR, BicepProvider.validatePreflight() will be wrapped as a gate, making it the first gate in the azd validate pipeline alongside the new project-config gate. The existing checks (role_assignment_permissions, ai_model_quota, reserved_resource_names) become Check entries in that gate.

What is NOT in this PR

• Migration of the existing bicep local preflight (preserves backward compat, follow-up)
• Extension gRPC surface for gate/check contribution (Model B — future)
• azure.yaml configuration for gate enablement (future)

Testing

• 11 unit tests in pkg/validate/pipeline_test.go covering:
  • Empty pipeline, single gate, warnings vs errors
  • Abort vs continue behavior
  • Gate execution order, context cancellation
  • Nil results (skipped gates), pipeline context values
• Snapshot tests updated for new command
• golangci-lint, cspell, gofmt, go fix, copyright check — all clean

Resolves #7817