Fail sample validation when Bicep warns that PostgreSQL TLS settings are unsupported #2053

What content needs to be created or modified?

The Bicep validation job can pass while the compiler emits BCP036 Warning for an unsupported PostgreSQL tls value.

Describe the solution you'd like

In the existing validator, fail BCP036/BCP037 diagnostics directly naming tls in the PostgreSQL demo even when Bicep exits zero. Match the diagnostic's actual source path as well as the compiled sample path; do not promote warnings from unrelated imported files. Do not rely on fixed line numbers or fail every lint warning. Preserve normal error/nonzero handling.

Add standard-library unittest fixtures for clean output, exit-zero TLS warnings, both diagnostic codes, source attribution, relative/absolute paths, unrelated properties/codes/files, and normal errors. Run them before compilation in the existing workflow. Coordinate semantics with samples without weakening its separate strict validation.

Where should the new material be placed?

.github/scripts/validate_bicep.py, focused tests beside it, and .github/workflows/validate-bicep.yaml.

The associated pull request from the Radius code repo, if applicable

N/A. Split from #2041.

Additional context

The original false-green run is https://github.com/radius-project/docs/actions/runs/38964910127/job/117188865986.