feat(grafanactl): add PublicNetworkAccess support for Grafana instances

[cssjr]

Summary

• Add PublicNetworkAccess field to grafanactl manage reconcile command, enabling control of whether Azure Managed Grafana instances are accessible from the public internet
• Default is Disabled (secure-by-default) — environments that need public access (e.g. dev) explicitly override to Enabled via config
• Add pipeline schema and type support so GrafanaManage steps in pipeline YAML can pass this value via configRef

Follows the existing ZoneRedundancy pattern exactly.

Jira

• ARO-28696 — Update Grafana network restriction config (partially addressed: tool-level support; config wiring in ARO-HCP PR to follow)
• ARO-28697 — Add CI policy check to prevent Grafana public re-exposure (partially addressed: secure default of Disabled prevents accidental exposure)

Parent story: ARO-28693 — Restrict Grafana to MSFT Corp VPN and add safeguards

Test plan

• Unit tests for DefaultReconcileOptions() validates default is Disabled
• Unit tests for Validate() accepts Enabled/Disabled, rejects invalid values
• go build ./... passes for tools/grafanactl and pipelines modules
• go test ./... passes for pipelines module (schema/type tests)
• ARO-HCP follow-up PR wires config values and runs make materialize successfully

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds an explicit PublicNetworkAccess option to grafanactl manage reconcile (defaulting to Disabled) and wires it through to Azure Managed Grafana resource properties, while also exposing the same field in the pipelines schema/types so pipeline YAML can pass the value via config.

Changes:

• Added PublicNetworkAccess to grafanactl manage reconcile options, flag binding, and validation, with a secure default of Disabled.
• Plumbed PublicNetworkAccess into the ARM ManagedGrafanaProperties payload and dry-run logging.
• Extended pipelines schema (pipeline.schema.v1.json) and GrafanaManageStep type to include publicNetworkAccess.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tools/grafanactl/cmd/manage/options.go	Adds PublicNetworkAccess option with default, flag binding, and validation.
tools/grafanactl/cmd/manage/options_test.go	Adds unit tests for defaulting and validation of PublicNetworkAccess.
tools/grafanactl/cmd/manage/cmd.go	Sends PublicNetworkAccess into the ARM properties for create/update and logs it in dry-run output.
pipelines/types/pipeline.schema.v1.json	Extends the GrafanaManage step schema with publicNetworkAccess.
pipelines/types/common.go	Adds PublicNetworkAccess to GrafanaManageStep and includes it in RequiredInputs() dependency discovery.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cssjr]

Defaulting to "Disabled" provides a secure-by-default design but risks locking down all environments if this change isn't paired with the new ARO-HCP changes in a timely manner.

Defaulting to "Enabled" ensures backwards-compatibility if these were merged early but breaks the secure-by-default pattern.

My vote is for secure by default as I think the risk is low; however, I'm open to feedback.