Move AMPLS to Operations Tier

[FabienGilbert]

Description

Moved the AMPLS and its Private Endpoint to the Operations tier, so that it sits together with the Log Analytics Workspace. This includes the following changes:

1. Moved the Private DNS zones creation out of the private-link module and into its own module, so that the zones still get created in the Hub.
2. Added a parameter for the VNET Subnet PrivateEndpointNetworkPolicies setting in the spoke module, so that the Operations VNET subnet get created with that setting disabled.
3. Moved the Private DNS zones and the AMPLS creation out of the hub module and into the main template, so that they can be deployed to different tiers.

Issue reference

The issue this PR will close: #738

Checklist

Please make sure you've completed the relevant tasks for this PR out of the following list:

• All acceptance criteria in the backlog item are met
• The documentation is updated to cover any new or changed features
• Manual tests have passed
• Relevant issues are linked to this PR

[lisamurphy-msft]

This provides a more streamlined approach with logical separation of resources.
Extensive testing proved successful and I see no reason not to approve this PR

[lisamurphy-msft]

/azp run

[azure-pipelines]

Azure Pipelines could not run because the pipeline triggers exclude this branch/path.