Add support for SecretManagement and SecretStore providers, enhance configuration data handling, and introduce new utility functions

Readme.md

@@ -111,7 +111,7 @@ FarmPassphrase = @{
     Sensitive = $true
     Value = @{
         Provider = 'KeePass'
-        Vault = 'BGW'
+        Vault = 'Contoso'
         Name = 'SharePoint/FarmPassphrase'
     }
 }
@@ -122,9 +122,9 @@ SetupCredential = @{
     Sensitive = $true
     Value = @{
         Provider = 'KeePass'
-        Vault = 'BGW'
-        Name = 'SharePoint/SetupAccount'
-        UserName = 'BGW\SVC_SHP_SETUP'
+        Vault = 'Contoso'
+        Name = 'Application/SetupAccount'
+        UserName = 'CONTOSO\svc-app-setup'
     }
 }
 ```
@@ -134,13 +134,113 @@ Secret references are validated and resolved by `Resolve-DSCConfigurationData` b
 ```powershell
 $resolved = Resolve-DSCConfigurationData -ConfigurationData $merged -ProviderSettings @{
     KeePass = @{
-        DefaultVault = 'BGW'
+        DefaultVault = 'Contoso'
     }
 }
 ```
 
 Use `-SkipSecrets` when you only want structural validation/resolution without loading provider secrets.
 
+For unattended KeePass access, pass the KeePass master key through `ProviderSettings`, not through the PSD1 parameter definition:
+
+```powershell
+$resolved = Resolve-DSCConfigurationData -ConfigurationData $merged -ProviderSettings @{
+    KeePass = @{
+        DefaultVault = 'Contoso'
+        MasterKey = (Get-Secret -Name 'KeePass-Contoso-MasterKey')
+    }
+}
+```
+
+You can generate the provider settings file with:
+
+```powershell
+Register-DSCConfigurationDataCredentialProvider `
+    -Provider KeePass `
+    -Vault Contoso `
+    -KeyPath 'C:\DSC\Contoso\KeePass-Contoso.key' `
+    -SettingsPath 'C:\DSC\Contoso'
+```
+
+SecretManagement can be initialized through the same entry point:
+
+```powershell
+Register-DSCConfigurationDataCredentialProvider `
+    -Provider SecretManagement `
+    -Vault LocalStore `
+    -ModuleName Microsoft.PowerShell.SecretStore `
+    -RegisterVault `
+    -DefaultVault `
+    -SettingsPath 'C:\DSC\Contoso'
+```
+
+SecretStore can also be configured for unattended local usage:
+
+```powershell
+Register-DSCConfigurationDataCredentialProvider `
+    -Provider SecretStore `
+    -Vault LocalStore `
+    -ConfigureSecretStore `
+    -Authentication None `
+    -Interaction None `
+    -RegisterVault `
+    -DefaultVault `
+    -SettingsPath 'C:\DSC\Contoso'
+```
+
+Provider setup can be removed again:
+
+```powershell
+Unregister-DSCConfigurationDataCredentialProvider `
+    -Provider KeePass `
+    -Vault Contoso `
+    -SettingsPath 'C:\DSC\Contoso' `
+    -KeyPath 'C:\DSC\Contoso\KeePass-Contoso.key' `
+    -RemoveKeyFile
+```
+
+For SecretManagement or SecretStore vault registration:
+
+```powershell
+Unregister-DSCConfigurationDataCredentialProvider `
+    -Provider SecretStore `
+    -Vault LocalStore `
+    -SettingsPath 'C:\DSC\Contoso' `
+    -UnregisterVault
+```
+
+Use `-ResetSecretStore` only when you intentionally want to delete all secrets from the local SecretStore.
+
+Then use it directly:
+
+```powershell
+$resolved = Resolve-DSCConfigurationData `
+    -ConfigurationData $merged `
+    -ProviderSettingsPath 'C:\DSC\Contoso\ProviderSettings.KeePass.psd1'
+```
+
+For portable unattended tests, use an AES key file with `ConvertFrom-SecureString -Key`:
+
+```powershell
+$resolved = Resolve-DSCConfigurationData -ConfigurationData $merged -ProviderSettings @{
+    KeePass = @{
+        DefaultVault = 'Test'
+        MasterKey = @{
+            ProtectedValue = '76492d1116743f0423413b16050a5345...'
+            KeyPath = 'F:\Secrets\KeePass-Test.key'
+        }
+    }
+}
+```
+
+`MasterKey` also supports:
+
+```powershell
+MasterKey = @{
+    EnvironmentVariable = 'KEEPASS_TEST_MASTERKEY'
+}
+```
+
 ### Secret Provider Files
 
 Secret providers are loaded automatically from the module folder `Providers`.
@@ -182,6 +282,42 @@ The KeePass provider is implemented in:
 Providers\Provider.KeePass.ps1
 ```
 
+Built-in providers:
+
+- `KeePass`: uses `PoShKeePass` / `Get-KeePassEntry`
+- `SecretManagement`: uses `Microsoft.PowerShell.SecretManagement` / `Get-Secret`
+- `SecretStore`: convenience provider for local SecretStore vaults through `Get-Secret`
+
+SecretManagement example:
+
+```powershell
+SetupCredential = @{
+    Type = 'credential'
+    Required = $true
+    Sensitive = $true
+    Value = @{
+        Provider = 'SecretManagement'
+        Vault = 'LocalStore'
+        Name = 'SharePointSetupCredential'
+    }
+}
+```
+
+SecretStore example:
+
+```powershell
+FarmPassphrase = @{
+    Type = 'secureString'
+    Required = $true
+    Sensitive = $true
+    Value = @{
+        Provider = 'SecretStore'
+        Vault = 'LocalStore'
+        Name = 'SharePointFarmPassphrase'
+    }
+}
+```
+
 Array values can be restricted item by item:
 
 ```powershell