Create policy exemptions for Defender for Cloud recommendations

https://learn.microsoft.com/en-us/azure/templates/microsoft.authorization/policyexemptions?pivots=deployment-language-bicep

## Considerations

- Multiple different policy initiative assignments from multiple regulatory frameworks can be in scope.
- Not all compliance initiatives use the same policy definitions and even when they do, the policy reference IDs might be different.

## Create exemptions for:

- [ ] Imaging storage account: vnet rules, private link, access key

- Spoke private storage account
- [x] Allow using access key (must be enabled for ADF to target Azure Files)
- [ ] Do not require service endpoint (private endpoints used)
- Airlock storage account (hub or spoke)
- [ ] Allow using access key (must be enabled for ADF to target Azure Files)
- [ ] Do not require service endpoint (private endpoints used)