Metabase Cloud customers cannot access resources in a virtual private cloud via VPC Peering, PrivateLink, or VPN

**Is your feature request related to a problem? Please describe**
Customers who would like to use Metabase Cloud often must self-host in able to access their data sources in a private VPC. This is often due to regulatory/legal requirements and to improve security/reduce surface area of risk.

**Describe the solution you'd like**

* Add support for at least one of the following:
* (preferred) VPN access to VPCs with data sources - works with the most Cloud Providers
* AWS PrivateLink - only works for AWS, but most often requested at time of writing
* AWS VPC Peering - only works with AWS, probably difficult to implement compared to the other two, and least often requested

Open to alternatives, those just seem like they would have addressed the most requests so far from customers.

**Describe alternatives you've considered**

* no change - this is a dealbreaker for a lot of customers that requires them to self-host
* [SSH Tunnels]() with [IP Whitelisting]() - not as secure as requested solutions and also a dealbreaker for customers requiring high throughput or where SSH Tunnels don't meet their legal requirements, also requires customer maintenance of a bastion which they may or may not have capacity to do.

**How important is this feature to you?**

* dealbreaker for a lot of customers requiring them to self-host
* enables using Metabase for more sensitive data and data governed by regulations/legal requirements
* requested by customers and prospects at least monthly, probably more like weekly
* offered by leading enterprise-grade BI tools (PowerBI, Tableau, Looker)

**Additional context**

* Should likely be combined with:
* [https://github.com/metabase/harbormaster/issues/3763]()
* Would not address customers hosting on Azure, GCP, or others unless we deliver VPN

Start by reviewing this issue's VPN, AWS PrivateLink, and AWS VPC Peering alternatives, then read the linked Harbormaster issue 3763 and the referenced SSH tunnel and IP allowlist documentation. The issue does not identify implementation files or tests; done would require an agreed design and support for at least one private connectivity option, including its cloud-provider scope.

Written by the indexing model from the issue text.