Add env --changed to print values that differ from azd env

[jongio]

Local service environment can drift from the active azd environment. Add a focused env view that shows only keys whose resolved local value differs from the active azd environment value.

Acceptance criteria:

• azd app env <service> --changed prints only changed keys.
• It works with --format dotenv, --format shell, and --format json.
• Masking behavior stays the same unless --no-mask is set.