Use the correct bitwise operator for combining flags (#10325)

Author: jeskew

src/Bicep.Core.IntegrationTests/ScenarioTests.cs

@@ -4545,5 +4545,36 @@ param workspaceName string
 
             result.Should().NotHaveAnyDiagnostics();
         }
+
+        // https://github.com/Azure/bicep/issues/10321
+        [TestMethod]
+        public void Test_Issue10321()
+        {
+            var result = CompilationHelper.Compile(
+("main.bicep", @"
+module mod 'mod.json' = {
+  name: 'mod'
+  params: {
+    secret: kv.getSecret('secret')
+  }
+}
+
+resource kv 'Microsoft.KeyVault/vaults@2019-09-01' existing = {
+  name: 'kv'
+}
+"),
+("mod.json", @"{
+  ""$schema"": ""https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#"",
+  ""contentVersion"": ""1.0.0.0"",
+  ""parameters"": {
+    ""secret"": {
+      ""type"": ""secureString""
     }
-}
+  },
+  ""resources"": []
+}"));
+
+            result.ExcludingLinterDiagnostics().Should().NotHaveAnyDiagnostics();
+        }
+    }
+}

src/Bicep.Core/Semantics/ArmTemplateSemanticModel.cs

@@ -162,7 +162,7 @@ TemplateParameterType.String when TryCreateUnboundResourceTypeParameter(resolved
                     TemplateParameterType.Array => GetArrayType(resolved),
                     TemplateParameterType.Object => GetObjectType(SourceFile.Template!, resolved),
                     TemplateParameterType.SecureString => GetStringType(resolved,
-                        TypeSymbolValidationFlags.IsSecure & (allowLooseAssignment ? TypeSymbolValidationFlags.AllowLooseAssignment : TypeSymbolValidationFlags.Default)),
+                        TypeSymbolValidationFlags.IsSecure | (allowLooseAssignment ? TypeSymbolValidationFlags.AllowLooseAssignment : TypeSymbolValidationFlags.Default)),
                     TemplateParameterType.SecureObject => GetObjectType(SourceFile.Template!, resolved, TypeSymbolValidationFlags.IsSecure),
                     _ => ErrorType.Empty(),
                 };