roachprod: support private IPs for load balancers (AWS NLB and GCE)

Currently, `roachprod load-balancer` commands (`ip`, `list`, `pgurl`) only expose public DNS names / public IPs for load balancers. For workloads running inside the same VPC/network, this forces traffic through the public route (via IGW on AWS), adding unnecessary latency and data transfer costs.

**Motivation:**
- AWS internet-facing NLBs have private IPs on their ENIs (one per AZ/subnet), but these are not exposed through the ELBv2 API or roachprod. They can be discovered via `ec2 describe-network-interfaces`.
- Workloads running in the same VPC/region can connect via private IPs for lower latency, no public data transfer costs, and no IGW dependency.
- Cross-AZ data transfer costs $0.01/GB — being able to filter by AZ enables same-AZ routing to avoid this.

**Proposed Changes:**

1. Add a `--private` flag to `roachprod load-balancer ip` and `roachprod load-balancer list` to return private IPs instead of public DNS/IPs.
2. Add a `--az` / `--zone` flag to filter results to a specific availability zone, useful for same-AZ routing.
3. Update `roachprod load-balancer pgurl` to support `--private` flag for generating pgurls with private IPs.
4. **AWS implementation:** Query ENIs via `ec2 describe-network-interfaces` filtered by NLB description pattern `ELB net//*` to extract per-AZ private IPs.
5. **GCE implementation:** Query forwarding rule IPs or backend service endpoints for private addresses.

Epic: none

Jira issue: CRDB-62931