A development team currently hardcodes API keys, database connection strings, and TLS certificates directly into application configuration files stored in a code repository. Security auditors flagged this practice as a major risk. The team wants an Azure service that centrally stores these secrets and certificates, controls access through policies, and lets applications retrieve them at runtime without embedding them in code. Which Azure service should they use?