Keep tutorial database passwords out of command arguments #2050

What content needs to be created or modified?

The PostgreSQL getting-started tutorial passes a generated password through a CLI argument. That can expose the value through process listings. The password-handling improvement is being split out of #2041 because it is independent of TLS enforcement.

Describe the solution you'd like

Use a protected temporary ARM JSON parameter file: generate a URI-safe random hexadecimal password, disable shell tracing, use umask 077, and pass only the file path to rad deploy. Remove the file and directory on success and failure. Explain Linux/macOS or WSL Linux-filesystem requirements; Windows filesystem permissions differ. Warn against generating a different password when retrying against an existing database. Preserve the authored Secret and connection names.

Verify file mode 0600, directory mode 0700, valid parameter JSON, no credentials in arguments/output, and cleanup on both success and failure. Coordinate the sample's password parameter description with radius-project/samples.

Where should the new material be placed?

docs/content/getting-started/add-connection/_index.md, related shell prerequisites in install-radius/_index.md, and the upstream sample description.

The associated pull request from the Radius code repo, if applicable

N/A. Split from #2041.

Additional context

The removed implementation and local test evidence remain in the history of #2041. This is a password-delivery improvement, not a prerequisite for the PostgreSQL TLS policy fix.