ISO template users can optionally provide a `TF_VAR_resource_ip_whitelist` env-var to control the VNET white-list

All Submissions:

[YES] Have you followed the guidelines in our Contributing document?
[YES] Have you added an explanation of what your changes do and why you'd like us to include them?
[YES]I have updated the documentation accordingly.
[YES] I have added tests to cover my changes.
[YES] All new and existing tests passed.
[YES] My code follows the code style of this project.
[YES] I ran lint checks locally prior to submission.
[YES] Have you checked to ensure there aren't other open Pull Requests for the same update/change?

What is the current behavior?

ISO template users must provide whitelist IP/CIDR input via the infra/templates/az-isolated-service-single-region/terraform.tfvars file (and thus check-in a change to that file to account for their specific self-hosted build agents)

Resolves Issue Number #341

What is the new behavior?

ISO template users can optionally provide a TF_VAR_resource_ip_whitelist environment variable (via many means, including Az Pipeline Variable Groups) to control the whitelist.

Users that do not use the new, optional env var will see the same behavior as before.

microsoft / cobalt