example for DDoS plan enforcement misses LZ management group

### What are your reporting a bug for?

ALZ Terraform (AVM)

### What versions of the tools are you using?

_No response_

### What is the bug?

See:

https://github.com/Azure/terraform-azurerm-avm-ptn-alz/blob/f23afe38223f3ef882cd9fc68971c5ae789b0e63/examples/management/main.tf#L47

To be effective, this would also need to point to the landing-zone management group, as the Enforce-DDoS-VNET is there too.

### Log Output

```Text

```

### Screenshot(s)

_No response_

Start at examples/management/main.tf around line 47 and inspect how the DDoS plan is assigned. Confirm the landing-zone management group scope and compare it with the location of Enforce-DDoS-VNET. Done means the example points to the landing-zone management group so the DDoS policy is effective there.

Written by the indexing model from the issue text.