feat: Implement `azdo pipelines variable-group show` command

[tmeckel]

This issue tracks the implementation of the azdo pipelines variable-group show command.

Command Description

Display metadata for a variable group, including its authorization state and variables. The Azure CLI retrieves the group via TaskAgentClient.get_variable_group and supplements the response with get_authorize_resource (source). azdo should provide the same detail with improved targeting ergonomics and opt-in verbosity to keep output manageable.

azdo Command Signature

azdo pipelines variable-group show [ORGANIZATION/]PROJECT/VARIABLE_GROUP_ID_OR_NAME [flags]

Flags:

• --include-variables: Include the full variables map (default table output shows only variable names/counts).
• --include-project-references: Include variableGroupProjectReferences details.
• --include-provider-data: Emit provider payloads (AzureKeyVaultVariableGroupProviderData, etc.).
• JSON export flags registered with the view struct fields (id, name, type, description, isShared, authorized, authorizedPipelines, variables, variableGroupProjectReferences, providerData, createdBy, createdOn, modifiedBy, modifiedOn). Even when include flags are off, JSON consumers can explicitly select those fields.

Behavior

• Resolve scope via the shared helper (util.ParseProjectTargetWithDefaultOrganization)
• Accept either a numeric ID or case-insensitive name after the [ORGANIZATION/]PROJECT positional argument.
• Invoke shared.ResolveVariableGroup with the resolved ID; surface a not-found error if the SDK returns nil.
• Call the approvals/permissions helper to determine whether the group is authorized for all pipelines; include the list of explicitly authorized pipelines when available.
• List output defaults to ID, NAME, TYPE, AUTHORIZED, VARIABLE COUNT, DESCRIPTION. Append VARIABLE KEYS, PROJECT REFERENCES, and PROVIDER DATA columns when the corresponding include flags are set.
• Use a GO text template to render the output
• JSON output uses a dedicated view struct. Map identities with { id, displayName, uniqueName }, format timestamps via types.FormatTimestamp, expand variables into a sorted slice of { name, secret, readOnly, value *string } objects (omit value for secrets), and include provider/project data only when requested.
• Add zap.L().Debug logs for identifier resolution, API durations, and authorization lookups.

Command Wiring

• Implement the command in internal/cmd/pipelines/variablegroup/show/show.go (NewCmd(ctx util.CmdContext) *cobra.Command).
• Register it from internal/cmd/pipelines/variablegroup/variablegroup.go so azdo pipelines variable-group show is discoverable.
• Regenerate documentation (make docs) after wiring changes.

SDK / Client Requirements

• Requires the Task Agent client (ClientFactory().TaskAgent(...)) plus the approvals/permissions helper (Approvals & Checks or Service Endpoint client) to compute authorization state. If any required client is missing, follow "Handling Missing Azure DevOps SDK Clients" in AGENTS.md.

References

• Azure CLI implementation: variable_group_show
• Azure DevOps REST API 7.1: Get variable group