chore(providers): upgrade azurerm to 4.x (~> 4.20)

[JoshLuedeman]

Summary

Phase 1 fleet upgrade — governance/edge cohort.

• Bump azurerm to ~> 4.20 (was ~> 3.116) in root and both examples/*/example_new_rg.
• Raise required_version to >= 1.10 (was >= 1.9).
• Declare azapi ~> 2.0 and keep popsrox POps-Rox/azutils ~> 1.0 in required_providers for fleet alignment.
• Subnet codemod: replaced deprecated private_endpoint_network_policies_enabled = true on azurerm_subnet.snet_ep with private_endpoint_network_policies = "Enabled" (4.x: bool arg → string enum).
• Prune stale output "echo_text" references in both example outputs.tf files — they pointed at a non-existent module.echo (latent on main; blocked the upgraded terraform validate gate).
• Add VERSION file at 2.0.0.

Codemods applied

Codemod	Hits	Notes
enable_https_traffic_only → https_traffic_only_enabled	0	n/a
allow_blob_public_access → allow_nested_items_to_be_public	0	n/a
enable_rbac_authorization → rbac_authorization_enabled	0	n/a
private_endpoint_network_policies_enabled → private_endpoint_network_policies enum	1	resources.template.private.endpoints.tf: true → "Enabled".
azurerm_monitor_diagnostic_setting.retention_policy block removal	0	none present

Validation

# Root (with transitive-overlay workaround from phase1-codemods.md §1.7)
terraform get
# patch .terraform/modules/**/versions.tf  ~> 3.116 -> ~> 4.20
terraform init -backend=false -get=false
terraform validate                                   # Success!

# examples/Government/example_new_rg                  # Success!
# examples/Commerical/example_new_rg                  # Success!

Breaking changes for consumers

• azurerm 4.x requires subscription_id on the provider block (or ARM_SUBSCRIPTION_ID env var).
• Terraform >= 1.10 required.
• var.enable_private_endpoint = true consumers: no consumer-facing change — the rename is on the internal azurerm_subnet resource argument; the module's variable surface is unchanged.

Cross-module dependency

Transitive sibling overlays (terraform-az-overlays-azregionslookup, -resourcegroup) still pin azurerm ~> 3.116 on main. Local validation used the codemod-doc workaround (terraform get + in-place patch of .terraform/modules/**/versions.tf). CI will pass cleanly once those sibling overlays publish 4.x-compatible releases.

Refs Phase 1 fleet upgrade.

---

Co-authored-by: Copilot