[AVM Module Issue]: Support private endpoints without Private DNS Zone registration in AI Foundry AVM

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Issue Type?

Feature Request

### Module Name

avm/ptn/ai-ml/ai-foundry

### (Optional) Module Version

_No response_

### Description

# Support private endpoints without Private DNS Zone registration in AI Foundry AVM

## Issue

`br/public:avm/ptn/ai-ml/ai-foundry` appears to couple private endpoint creation with Private DNS Zone resource IDs / DNS zone group creation.

In enterprise hub/spoke landing zones, Private DNS Zones are often owned by a central platform/network team. Workload deployment identities can create resources and private endpoints in the spoke, but cannot write to hub-owned DNS zones. DNS registration is commonly handled by Azure Policy.

## Expected behavior

The module should support creating private endpoints and enabling private AI Foundry / Agent Service networking without requiring Private DNS Zone IDs or creating DNS zone groups.

Example option:

```bicep
privateDnsZoneGroupEnabled: false

### (Optional) Correlation Id

_No response_