Provide full support for Azure Monitor Private Link Scopes

### Community Note

- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

### Description

#### Is your feature request related to a problem?

There does not appear to be full support for using the ALZ module with Azure Monitor Private Link Scopes (AMPLS).

As per https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-security, AMPLS is a major component in reducing the risk of data exfiltration. As per https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-design, AMPLS requires associated Log Analytics workspaces to use customer-managed storage accounts for custom log ingestion. Those storage accounts must be accessible via private links, which require virtual network connectivity.

The ALZ module documentation is lacking relative to the deployment of azurerm_log_analytics_linked_storage_account, azurerm_monitor_private_link_scope, and azurerm_monitor_private_link_scoped_service for the Log Analytics workspace(s) deployed by the Management Resources. Specifically consider the example at https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/wiki/%5BExamples%5D-Deploy-using-multiple-module-declarations-with-remote-state#coremaintf. Being a networking concern, it seems like the aforementioned AMPLS resources should reside alongside the Connectivity configuration, not Management. Assuming that is proper, that would imply that the Connectivity configuration would need to take a dependency on the remote configuration of the Management Resources. Some clarification here would be appreciated, as incorrectly adding dependencies could cause problems with future module expansion.

More importantly, the Management Resources do not currently expose any means of configuring the following components of the Log Analytics workspace(s):

1. azurerm_log_analytics_workspace.cmk_for_query_forced
2. azurerm_log_analytics_workspace.internet_ingestion_enabled
3. azurerm_log_analytics_workspace.internet_query_enabled

#### Describe the solution you'd like

There is high value in documenting a recommended approach for deploying AMPLS with this module, especially when using separate configuration for Identity/Core, Management, and Connectivity.

The Management configuration should support the above azurerm_log_analytics_workspace attributes in a first-class way.

The only way to alter that configuration today requires the use of the advanced settings, which as per https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/wiki/%5BExamples%5D-Deploy-Management-Resources-With-Custom-Settings is undocumented, experimental, and seemingly full of risk.

Start with the ALZ module's Management and Connectivity configuration, the coremaintf remote-state example, and the advanced custom-settings example referenced in the issue. Review how azurerm_log_analytics_linked_storage_account, azurerm_monitor_private_link_scope, azurerm_monitor_private_link_scoped_service, and the three requested workspace attributes fit together. Done means a documented AMPLS deployment approach and first-class support for the requested workspace settings, with the configuration boundary and dependency clarified.

Written by the indexing model from the issue text.