Restrict managed disk import/export through private endpoints

https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-private-links-for-import-export-portal#create-a-disk-access-resource

This would likely involve pre-creating the disks so that we can set `networkAccessPolicy = 'DenyAll'` and then use the disk resource ID in the `storageProfile/osDisk/mangedDisk[id]` property.

Start with the linked Azure documentation on disk access resources and private links, then inspect the repository's Bicep resource definitions for managed disks and virtual machines. The work is done when import/export disks use networkAccessPolicy = 'DenyAll' and the VM osDisk managedDisk[id] references the pre-created disk resource.

Written by the indexing model from the issue text.