feat(trusted.ci) set up PLS and PEs for agents

[dduportal]

Ref jenkins-infra/helpdesk#4402 (comment)

This PR adds an Azure Private Endpoint in the subnet of the ephemeral agents to allow the crawler job to reach the Update Center Rsync Data service.

It utilizes a local module (no need to share this module outside the repository as it's only used here) to encapsulate the logic and allow passing providers (ephemeral agents and PLS are not in the same subscription, which requires multiple providers. But providers cannot be resolved dynamically so no for_each solution).

It also removes the existing private DNS zone used to provide private access to the container ACR, as only 1 private zone can be linked to a given virtual network. trusted.ci does not have container caching anymore. We might be able to re-create a new endpoint and add a custom records, but the configuration will have to be changed.

---

Edit: 2 hotfixes were required:

• Forgot to add the modules files. Fixed by commit 98573b8
• Forgot to add the NSG rules to allow access. Fixed by PR fix(trusted.ci/ephemeral-agents) add NSG rules to allow access the PE #892