Add delete locks to engsys infra resources

For various legacy resources which do not have corresponding bicep templates and/or infra config version control, we should put a couple more guardrails in place around preventing deletion.

https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json

- Check Enforcer
- Webhook Router
- Pipeline Witness (is this still used @hallipr?)
- Live test and access token keyvaults