Add Azure Network Security Perimeter (NSP) support

[eerhardt]

Description

Implement NSP resources for securing PaaS services (Storage, Key Vault, Cosmos DB, SQL) within a logical network boundary. NSPs are the PaaS-layer equivalent of VNets/NSGs, grouping resources so they can communicate internally while restricting public access via access rules.

New APIs:

• AddNetworkSecurityPerimeter() - creates an NSP with a default profile
• WithAccessRule() - adds inbound/outbound rules (IP prefixes, subscriptions, FQDNs, service tags)
• AssociateWith() - explicitly associates a PaaS resource with an NSP
• AssociateAllPaaSResources() - auto-associates all IAzureNspAssociationTarget resources in the app model

New types:

• AzureNetworkSecurityPerimeterResource
• AzureNspAccessRule (DTO for rule configuration)
• IAzureNspAssociationTarget (implemented by Storage, KeyVault, CosmosDB, SQL)
• NspAssociationTargetAnnotation (for provisioning dependency ordering)

Associations use Enforced access mode by default. Generated Bicep targets the 2025-05-01 API version via Azure.Provisioning.Network 1.1.0-beta.2.

Checklist

• Is this feature complete?
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • No
• Does the change require an update in our Aspire docs?
  • Yes
    • Link to aspire.dev issue:
      • New issue

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 15711

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 15711"