DCGW: Public DCGW how to

## Jobs to be done (optional)
Working on the DCGW network architecture docs, I realize we're missing a public DCGW how to. We've got the private DCGW paths relatively well covered, but nothing for public that someone wouldn't have to piece together.

## Definition of done
- Create a how to (I don't know if this can be tested) that walks users though creating the network (maybe?), creating the public DCGW and setting up all the correct steps in the correct order so that they don't open routes/services to the scanners, plus example plugin configs:
1. *Before* creating Gateway Services and Routes, create the Dedicated Cloud Gateway network and control plane in {{site.konnect_short_name}}.
The network will be scanned, but since there aren't any Routes, scanners get 404s or connection resets.
2. Configure your CDN/WAF in front of the Kong NLB before you configure any Routes or Services.
1. Allowlist the Dedicated Cloud Gateway network egress IPs.
3. Configure the IP Restriction plugin globally (allowlisting your CDN's egress IPs) so that even if someone hits the Kong NLB directly, they get rejected before any Route matching happens.
4. Configure your Routes and Services pointing to real upstreams.
- This is a solution guide.
- Before any steps, need a planning section so the pieces are decided (and we communicate what opinionated choices we're making and why) before they start the DCGW.

## Information

## Due date (optional)

## Size
L

Start with the existing private DCGW network architecture docs and the public DCGW how-to scope described here. Draft a solution guide with a planning section, the required creation and configuration order, scanner-safety guidance, and example plugin configurations; it is done when users can set up a public DCGW without exposing Routes or Services prematurely.

Written by the indexing model from the issue text.