Which secret management approach avoids storing secret values in the Container App definition?

1. A Environment variables with literal values
2. ✓ B Container Apps secrets referencing Key Vault via managed identity (correct answer)
3. C Baking secrets into the image
4. D Storing secrets in a ConfigMap

Shortcut: Container Apps secrets can reference a Key Vault secret URI and resolve it at runtime using the app's managed identity, so the value never appears in the ARM/Bicep definition.