Add TDE with a customer-managed Key Vault key to the SQL Database sample

[bryansan-local]

Motivation

The SQL Database sample only used Key Vault for a secret and a certificate. TDE with a customer-managed key is the common real use of Key Vault keys, and it covers the emulator's new Key Vault keys management plane and the SQL server keys / encryption protector APIs.

Changes

• The SQL server gets a user-assigned identity with get/wrapKey/unwrapKey on an RSA key, set as the TDE protector with auto-rotation (Python and .NET; az CLI, Bicep, Terraform).
• The az CLI deployment uses az resource create for the server key and protector, since az sql server key create / tde-key set reject key ids outside *.vault.azure.net, like the emulator's.
• Terraform gets a deployer access policy, which was also missing for the secret and certificate.
• validate.sh checks the protector and TDE state, and run-samples.sh now runs it for Terraform too.

Tests

• All six deployments tested end to end on real Azure and on the emulator.