Vertex/Bedrock/Foundry inference settings hardened

Several Vertex, Bedrock, and Foundry inference settings are now more locked down: Vertex's region/baseUrl and Bedrock's ssoRegion gained readers: ["desktop", "m365"] restrictions and/or requiresUserConsent on remote policy. The Vertex OAuth clientSecret field's redaction changed from redact: "drop" to redact: "presence", with a new hint that Google treats installed-app client secrets as non-confidential, so it may be set from hosted config.