Building on Samples to create a fully private Hub/Spoke config with multiple clusters

[khowling]

Building on @Gordonby samples, to provision a fully private hub/spoke multi-cluster environment. This environment would showcase

Centralised (Hub-based)

• WAF
• Firewall
• Private DNS zone
• Monitoring ???

De-centralised (spoke-based)

• Ingress
• Private sub-zone
• Private link dependencies

It will showcase the following capabilities

• Using the helper to generate multiple independent spoke clusters, with bespoke configurations (sandbox, connected, nodepools etc)
• Publishing a private ingress with TLS, callable from another spoke cluster

[khowling]

We'd need to:

1. Ensure our current modules we currently provision in the spoke can be called to create a hub (firewall, appgw, dns)
2. Add a networking option to the helper to create a vnet spoke against an existing hub (dont think we want to create a hub via the helper, I don't see value in that)
3. Option for private Ingress directly to the spoke, and public ingress via a WAF in the hub? or do we still want to make WAF ingress a spoke thing?

[Gordonby]

I'd like to be able to have this as an Enterprise Scale (ALZ) preset as an alternative to the "Corp" scenario which needs BYO vnet.