Add secret provider functionality and enhance configuration data resolution

Readme.md

@@ -9,6 +9,13 @@ $merged = Merge-DSCConfigurationData -Template $service -Deployment $environment
 $resolved = Resolve-DSCConfigurationData -ConfigurationData $merged
 ```
 
+Pipeline flow:
+
+```powershell
+$resolved = Merge-DSCConfigurationData -Template $service -Deployment $environment |
+    Resolve-DSCConfigurationData
+```
+
 Expressions use an ARM-like syntax:
 
 ```powershell
@@ -122,11 +129,57 @@ SetupCredential = @{
 }
 ```
 
-Secret references are validated by `Resolve-DSCConfigurationData`, but they are resolved by `Resolve-DSCConfigurationSecrets` before the normal data resolve step:
+Secret references are validated and resolved by `Resolve-DSCConfigurationData` before the normal parameter and variable resolve step:
 
 ```powershell
-$withSecrets = Resolve-DSCConfigurationSecrets -ConfigurationData $merged
-$resolved = Resolve-DSCConfigurationData -ConfigurationData $withSecrets
+$resolved = Resolve-DSCConfigurationData -ConfigurationData $merged -ProviderSettings @{
+    KeePass = @{
+        DefaultVault = 'BGW'
+    }
+}
+```
+
+Use `-SkipSecrets` when you only want structural validation/resolution without loading provider secrets.
+
+### Secret Provider Files
+
+Secret providers are loaded automatically from the module folder `Providers`.
+The naming convention is:
+
+```text
+Providers\Provider.<Name>.ps1
+```
+
+Each provider registers itself with the same schema:
+
+```powershell
+$MyProvider = @{
+    Name = 'MyProvider'
+    SupportedTypes = @(
+        'credential',
+        'securestring',
+        'string'
+    )
+    Resolver = {
+        param(
+            [System.Collections.IDictionary] $Reference,
+            [string] $ExpectedType,
+            [hashtable] $ProviderSettings
+        )
+
+        # Return a PSCredential for ExpectedType = credential,
+        # a SecureString for ExpectedType = securestring,
+        # or a string for ExpectedType = string.
+    }
+}
+
+Register-ConfigurationDataSecretProvider @MyProvider
+```
+
+The KeePass provider is implemented in:
+
+```text
+Providers\Provider.KeePass.ps1
 ```
 
 Array values can be restricted item by item: