Direct module recipes: add cloud E2E functional tests for limitations not coverable in noncloud CI #12202

Background

Tracking issue for E2E tests requested in review of #12109 ("Implement direct module support for Recipes", design #11876). These paths cannot run in noncloud CI because they require a live Terraform registry and/or real cloud credentials, so they are currently validated at unit boundaries only. They should be added to a cloud functional run.

The existing noncloud functional test (Test_DirectModule_Terraform) covers a direct Terraform module served from a local HTTP archive with outputs mapping and {{context.*}} resolution. The items below are what it does not cover.

Gaps to cover with cloud E2E

1. Terraform registry module + <source>:<version> pinning — e.g. terraform-aws-modules/rds/aws:6.1.0. The <source>:<version> parsing in parseTerraformModuleSource is unit-tested, but real module download + version resolution from registry.terraform.io needs a live registry. Manually verified once via a demo repo (terraform-iaac/deployment/kubernetes:1.4.6, kind/k3d), never in CI.
2. Bicep direct module — no functional test exists at all. The entire Bicep direct-module path is unit-only: direct-module detection, wrapARMParameters (incl. nil-skip), and the ARM output → Values/Secrets split. Add a cloud (Azure) functional test, ideally against an Azure Verified Module (AVM).
3. Cloud-backed direct modules — AWS RDS (Terraform) and Azure AVM (Bicep) require real cloud credentials to deploy.
4. Auth-gated module sources — private Terraform registry, Git, and OCI module sources (credential handling on download).
5. Secret/sensitive output routing end-to-end — secureString/secureObject (Bicep) and sensitive (Terraform) outputs must land in Secrets (not Values), including x-radius-sensitive encryption-at-rest. Currently unit-only.

Notes

• Out of scope: link-time source-reachability validation (proposed as a separate follow-up feature, not a test gap).
• Companion issue tracks noncloud test-hardening gaps that do not need cloud.

Related: #12109, #11876