Update Windows Domain Join policy

### Community Note

- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

### Description
The [current policy definition](https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/blob/main/modules/archetypes/lib/policy_definitions/policy_definition_es_deploy_windows_domainjoin.json) to automatically enable the DomainJoin extension on windows VMs is missing the 2022 SKUs and needs access to the ```Microsoft.KeyVault/vaults/deploy/action``` permission to retrieve secret values from a key vault.

#### Is your feature request related to a problem?
Right now it seems users would have to deploy their own variation of this policy using archetype extensions or their own archetype configuration.

#### Describe the solution you'd like
I've prepared a solution in [this fork](https://github.com/QBY-MarkusMaring/terraform-azurerm-caf-enterprise-scale) which:

- Adds all 2022 windows server SKUs to the image filter ([commit](https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/commit/45effe78c5f3bc56164eb2a2f743d245d60c5f25))
- Specifies the Key Vault Contributor role definition in the policy definition ([commit](https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/commit/ad8fcd56dde159c285aedaec3ca8bba11e58c658))

Key Vault Contributor is the least access provided by any Azure built-in role aside from Desktop Virtualization Virtual Machine Contributor. This is not optimal since this policy will likely be assigned by users on a very high level that includes multiple management groups and key vaults. So an alterative solution might be to not include it and have the user manually assign this permission to the system assigned identity instead.

Additionally this fork adds a policy assignment ([here](https://github.com/QBY-MarkusMaring/terraform-azurerm-caf-enterprise-scale/blob/main/modules/archetypes/lib/policy_assignments/policy_assignment_es_deploy_windows_domainjoin.tmpl.json)) which was not included previously. However the default parameters make not much sense and would need to be replaced while assigning anyways (like the KeyVaultResourceID pointing to a key vault which won't be deployed in this module). So again an alterative solution might be to not include this in the feature and have users do it manually outside of this module.

#### Additional context
Let me know if this fork is a suitable solution and can be submitted as a PR. If so:

- Should the role definition be added here, or done manually by users?
- Should the policy assignment be included if the default parameters are unusable as-is?