feat(azure-policy): implement condition, expression, field, and template dispatch compilation (#686)

Fill in the compiler stubs for the evaluation layer.

Condition and wildcard compilation:
- Compile allOf/anyOf/not constraints, operator conditions with
  value-condition guards, and implicit allOf for unbound [*] fields
  via recursive Every loops.
- Defensively lowercase prefix/suffix path segments in wildcard
  handling for consistency with the collect path.

Expression and field compilation:
- Parse ARM template expressions and dispatch calls to parameters,
  field, current, resourceGroup, subscription, and others.
- Compile all FieldKind variants (type, id, name, location, tags,
  aliases, dynamic if/concat), resolve resource paths, and collect
  wildcard values via ForEach loops.

Template function dispatch:
- Wire up 50+ ARM template functions covering string, numeric,
  encoding, collection, date/time, logical, and comparison categories.

Compiler infrastructure (core.rs):
- Add emit helpers: load_literal, emit_builtin_call,
  emit_chained_index_literal_path, load_input, load_context,
  emit_coalesce_undefined_to_null, add_literal_u16, and
  get_or_add_builtin_index.
- Add alias resolution via resolve_alias_path and strip_fq_prefix.

Misc cleanup:
- Handle ARM template `[[` escape sequences in json_value_to_runtime
  and add a test for it.
- Tighten module visibility (pub -> pub(crate)/pub(super)) where
  appropriate.
- Add span context to bail errors in stubs so diagnostics carry
  source locations.
- Take CountBinding by reference in compile_from_binding.
- Suppress clippy warnings on the no-op memory_check stub.

src/rvm/vm/machine.rs

@@ -552,6 +552,7 @@ impl RegoVM {
     }
 
     #[cfg(any(miri, not(feature = "allocator-memory-limits")))]
+    #[allow(clippy::unused_self, clippy::missing_const_for_fn)]
     pub(super) fn memory_check(&mut self) -> Result<()> {
         Ok(())
     }