[Feature Request]: Define a 'secure-by-default' baseline for CARML

### Description

The modules we provide in CARML provide quite a lot of functionlity - including security features such as private endpoint support and 'secure' default values like TLS1.2.
In the past we did a sweep of the modules of that time and applied as many rules as possible of the following 2 sources
- [NIST 800](https://docs.microsoft.com/en-us/azure/governance/policy/samples/nist-sp-800-53-r5)
- [Built-in Policies](https://github.com/Azure/azure-policy)

However, ever since more module were added and it wasn't always clear what the 'secure-by-default' recommendation should be.

For example: Should we always set all values to the most secure value, even if that means that the module's deployment will require more effort by the user? An example could be to remove empty default values for private endpoints - essentially enforcing them - unless a user provides an explicit empty value as a parameter.

Looking at this from a more abstract level, this would mean: All modules can only be deployed with all security features enforced - and we need to describe how to (and the user have to make an effort to) deploy them in a less secure way.

Naturally this isn't a straight forward topic - especially as the user experience in this case may suffer.

Let's use this issue to keep the topic on the agenda and track the conversation.