Improve Default Network Isolation of Azure Services

.NET Aspire’s default is to expose Storage, Service Bus, CosmosDB, etc. to the public internet. This allows the ACA Container Apps to connect to the service without establishing a Virtual Network.

For database resources (like SQL and PostgreSQL), we limit it to only Azure IPs (which still means any service running in Azure, not just this app).

We should change the default experience to limit the created Azure Services to only be accessed by the apps created with Aspire. Developers would need to opt in to exposing their services publicly.