AKS: Auto-link Private DNS Zones for backing service private endpoints

## Problem
When backing Azure services (Storage, SQL, etc.) have private endpoints in the same VNet as AKS, pods need Private DNS Zone links to resolve the private endpoint DNS names. Currently this is not automated.

## Expected
When AKS is configured with `WithSubnet()` and a backing service has `AddPrivateEndpoint()` in the same VNet, the Private DNS Zone should be automatically linked to the AKS VNet so pods can resolve private endpoint DNS (e.g., `storageaccount.blob.core.windows.net` → private IP).

## Related
Part of AKS hosting support (PR #16088)