fix: handle refs without module

[matt2e]

closes #3526

• When validating a module, push all module decls into scopes
  • This allows refs without a module value to match local decls (like how builtins decls work)
• Any decls with the same name are no longer allowed
  • We previously checked for decl name clashes only within the same type
  • If we allow name clashes then refs can't uniquely refer to those nodes
  • We previously had a test to allow configs and secrets with the same name, but that sounds like a mistake waiting to happen (setting a secret as a config means we won't treat it securely)
• Centralise Ref normalisation: Validation visits child nodes before validating parent nodes, removing the need for parent nodes to handle refs without a module value