Workload resource groups referenced in resourceGroupCollection are never created or validated

The reusable enclave module and the environment templates that consume it add a workload association to a resource group that the templates never create or verify. Because `deployWorkload` defaults to `true`, a default deployment can produce a workload whose `resourceGroupCollection` points at a resource group that does not exist.

## Affected files

- [quickstart-templates/modules/enclave.bicep](https://github.com/Azure/enclave/blob/04510e90beff98b78716d2aa4fa04fbecc192963/quickstart-templates/modules/enclave.bicep)
- [quickstart-templates/azure-enclave-demo-env.bicep](https://github.com/Azure/enclave/blob/04510e90beff98b78716d2aa4fa04fbecc192963/quickstart-templates/azure-enclave-demo-env.bicep)
- [quickstart-templates/azure-enclave-edu.bicep](https://github.com/Azure/enclave/blob/04510e90beff98b78716d2aa4fa04fbecc192963/quickstart-templates/azure-enclave-edu.bicep)
- [quickstart-templates/azure-enclave-saca.bicep](https://github.com/Azure/enclave/blob/04510e90beff98b78716d2aa4fa04fbecc192963/quickstart-templates/azure-enclave-saca.bicep)

## Code path

In `modules/enclave.bicep`:

- `param deployWorkload bool = true` (line 94)
- `param workloadResourceGroupName string = ''` (line 104)
- `var effectiveWorkloadResourceGroupName = empty(trim(workloadResourceGroupName)) ? 'wl-rg-${toLower(enclaveName)}-...' : trim(workloadResourceGroupName)` (line 106)
- The workload resource (line 178) sets `resourceGroupCollection: ['${subscription().id}/resourceGroups/${effectiveWorkloadResourceGroupName}']` (line 185)

The resource group name is only converted into a resource ID; nothing in the module or the calling templates creates the resource group or checks that it already exists. The environment templates make this concrete by passing hard-coded names into the module with `deployWorkload: true`, for example:

- `azure-enclave-demo-env.bicep`: `rg-id-ADDS-...`, `rg-collab-apps-...`, `rg-desktops-...`, `rg-platform-apps-...`, `rg-weapon-apps-...`, `rg-subktr-apps-...`, `rg-cyber-apps-...`, `rg-offline-apps-...`
- `azure-enclave-edu.bicep`: `rg-shared-...`, `rg-project1-...`, `rg-project2-...`, `rg-enterp-...`
- `azure-enclave-saca.bicep`: `rg-id-ADDS-...`, `rg-operations-...`, `rg-shared-apps-...`, `rg-mission-apps-...`

None of these names is backed by a resource group creation step.

## Why this is a problem

A default deployment, and each of the provided environment templates, registers a workload whose `resourceGroupCollection` references a resource group that was never provisioned. Depending on how the `Microsoft.Mission/virtualEnclaves/workloads` resource validates the collection, this either fails the deployment or produces a workload that points at a non-existent resource group, which is a silent misconfiguration that surfaces later during use.

## Remediation options

1. Create the resource group before referencing it. Add a subscription-scoped resource group deployment (for example a `newResourceGroup.bicep` module wrapping `Microsoft.Resources/resourceGroups`) for each `effectiveWorkloadResourceGroupName`, and make the workload depend on it.
2. Make workload deployment opt-in. Default `deployWorkload` to `false` so a default deployment does not reference an uncreated resource group, and have callers enable it explicitly once the resource group is handled.
3. Require a validated, pre-existing resource group. Remove the empty-string default for `workloadResourceGroupName`, require a non-empty value, and document that the resource group must already exist (optionally validate through an `existing` reference before use).

Reported from review of [PR #2](https://github.com/Azure/enclave/pull/2) at head `04510e90beff98b78716d2aa4fa04fbecc192963`.

Start with quickstart-templates/modules/enclave.bicep, especially the deployWorkload and workloadResourceGroupName parameters and the workload resourceGroupCollection, then compare the three environment templates listed in the issue. Confirm how the deployment handles the referenced groups and agree on a remediation option with the maintainer; done means default and environment deployments do not reference uncreated resource groups.

Written by the indexing model from the issue text.