add diagnostics settings for firewall, public IP, and network security groups

[glennmusa]

Description

Defaults the diagnostic logs and metrics settings for these resources:

Azure Firewall

• AzureFirewallApplicationRule
• AzureFirewallNetworkRule
• AzureFirewallDnsProxy
• AllMetrics

Public IP Address

• DDoSProtectionNotifications
• DDoSMitigationFlowLogs
• DDoSMitigationReports
• AllMetrics

Network Security Group

• NetworkSecurityGroupEvent
• NetworkSecurityGroupRuleCounter

Virtual Network

• (user provided, empty otherwise)

Demo

To demo this, deploy MLZ as you usually would with az deployment sub create.

You can visually see these diagnostic settings by selecting "Diagnostic Settings" from any of the resource groups. For example, here's a Hub Resource Group Diagnostic Settings blade:

Issue reference

The issue this PR will close: #465

Checklist

Please make sure you've completed the relevant tasks for this PR out of the following list:

• All acceptance criteria in the backlog item are met
• The documentation is updated to cover any new or changed features
• Manual tests have passed
• Relevant issues are linked to this PR

[shawngib]

Should we make 'metrics' optional since they add expense that may not be required. Should logs even be optional? I thought we were also removing the TF virtual network diagnostic logging in this also, maybe making it an option parameter,

[glennmusa]

Should we make 'metrics' optional since they add expense that may not be required.

I don't think logs should be optional, but can see how Metrics might be. If we decide to make Metrics optional, let's do that in a different change in tandem with optional metrics in Terraform so that the implementations are consistent.

I thought we were also removing the TF virtual network diagnostic logging in this also, maybe making it an option parameter

There are no logs or metrics configured with the virtual network diagnostic setting resource, but they're opt-in in that a user can provide their own categories if they choose by providing values for those parameters.

[shawngib]

Works as designed.

[glennmusa]

cool beans @shawngib set up another item to trickle down opt-in metrics: #475