`Deploy-OnPrem-DNS-Rec` policy definition missing `scmSites` groupId for App Service SCM private endpoints

## Description

The `Deploy-OnPrem-DNS-Rec` policy definition in `platform/alz/policy_definitions/Deploy-OnPrem-DNS-Rec.alz_policy_definition.json` has a restricted list of allowed values for the `groupId` parameter that does not include `scmSites`, which is required for configuring DNS records for App Service SCM (Kudu) private endpoints.

## Current Behavior

The `groupId` parameter in the policy definition has these allowed values:
```json
"allowedValues": [
"storage", "blob", "file", "dfs", "table", "queue", "vault",
"registry", "postgresqlServer", "sqlServer", "Sql", "MongoDB",
"Cassandra", "Gremlin", "Table", "management", "managedEnvironments",
"account", "namespace", "topic", "domain", "Gateway",
"mysqlServer", "mariadbServer", "redisCache", "sites"
]
```

When attempting to use `groupId = "scmSites"` for App Service SCM private endpoints, the policy assignment fails with:

```json
{
"error": {
"code": "PolicyParameterValueNotAllowed",
"message": "The value 'scmSites' is not allowed for policy parameter 'groupId' in policy definition 'Deploy-OnPrem-DNS-Rec version 1.0.0'. The allowed values are 'storage, blob, file, dfs, table, queue, vault, registry, postgresqlServer, sqlServer, Sql, MongoDB, Cassandra, Gremlin, Table, management, managedEnvironments, account, namespace, topic, domain, Gateway, mysqlServer, mariadbServer, redisCache, sites'."
}
}
```

## Expected Behavior

The `groupId` parameter should include `scmSites` in its allowed values to support App Service SCM private endpoint DNS configuration.

## Impact

This prevents organizations from properly implementing private endpoint DNS policies for App Service SCM/Kudu endpoints, which are separate from the main web app endpoints and require their own DNS zone (`scm.privatelink.azurewebsites.net`).

## Proposed Solution

Add `scmSites` to the `allowedValues` array in the `groupId` parameter:

```json
"allowedValues": [
"storage", "blob", "file", "dfs", "table", "queue", "vault",
"registry", "postgresqlServer", "sqlServer", "Sql", "MongoDB",
"Cassandra", "Gremlin", "Table", "management", "managedEnvironments",
"account", "namespace", "topic", "domain", "Gateway",
"mysqlServer", "mariadbServer", "redisCache", "sites", "scmSites"
]
```

## References

- **File**: `platform/alz/policy_definitions/Deploy-OnPrem-DNS-Rec.alz_policy_definition.json`
- **Azure Documentation**: [App Service private endpoint documentation](https://learn.microsoft.com/en-us/azure/app-service/networking/private-endpoint) mentions two subresources:
- `sites` - for the main web app endpoint
- `sites` - for SCM endpoint (but with different DNS zone)
- **ALZ Library Version**: 2025.09.1

## Workaround

Currently, the only workaround is to:
1. Use `groupId = "sites"` for both web app and SCM endpoints (semantically incorrect)
2. Differentiate them only by DNS zone (`privatelink.azurewebsites.net` vs `scm.privatelink.azurewebsites.net`)

This workaround is not ideal as it doesn't properly distinguish between endpoint types in policy assignments.

## Environment

- ALZ Library Version: 2025.09.1
- Terraform Provider: Azure/alz ~> 0.19
- Date Discovered: October 8, 2025

## Additional Context

The issue was discovered while implementing the DNS policy assignments recommended in the ALZ documentation. The library includes a sample policy assignment file `DINE-WebApp-SCM-DNS-Rec.alz_policy_assignment.json` that references this policy, but the policy definition itself doesn't support the required `scmSites` value.

Open platform/alz/policy_definitions/Deploy-OnPrem-DNS-Rec.alz_policy_definition.json and locate the groupId parameter's allowedValues array. Compare it with DINE-WebApp-SCM-DNS-Rec.alz_policy_assignment.json and the referenced App Service private endpoint documentation. Done means the policy accepts the SCM groupId used by the sample assignment and the JSON remains valid.

Written by the indexing model from the issue text.