Add DNAT rule to Azure Firewall during post deploy

**Is your feature request related to a problem? Please describe.**
If the user has selected Azure Firewall + Ingress (Contour/Nginx/Traefik) selected, they will need a DNAT rule added to the Firewall for the ingress to be properly exposed.

**Describe the solution you'd like**
We could create this configuration during post-deploy after the IP for the ingress controller is known.
If the user is using a dedicated subnet for ingress controller IP's (#552) then we could even do this all in the bicep as we'll be able to assume the IP.

**Describe alternatives you've considered**
Creating it manually.

**Additional context**
https://learn.microsoft.com/en-gb/azure/aks/limit-egress-traffic#add-a-dnat-rule-to-azure-firewall

Start with the repository's post-deploy flow and the Azure DNAT guidance linked in the issue. Trace how the selected ingress controller's IP becomes available, then define the required Azure Firewall rule and verify that ingress traffic is exposed for the supported controller and subnet configurations.

Written by the indexing model from the issue text.