Fixes for August 2022 penetration test

[jemrobinson]

⤴️ Summary

• Remove unused keys from config files
• Fix comments
• Allow 503 errors when building documentation
• Add missing arguments and correct types for various function calls
• Refactor Resolve-KeyVaultPrivateKeyCertificate into dedicated function
• Add various missing module imports
• Add additional places where resource groups/storage accounts are created if they don't exist to allow for running scripts out-of-order
• Separate diskTypeDefault from storageTypeDefault and set this to Standard_LRS (nothing more than this is available in uksouth)
• Allow additional installation endpoints through the firewall
• Allow additional SSPR endpoints through the firewall
• Move firewall deployment earlier in the process so that VMs are deployed from behind the firewall
• Fix DC2 desired state configuration
• Downgrade to Ubuntu 20.04 through as 22.04 is incompatible with Update Management (see Move from Microsoft Monitoring Agent to Azure Monitor Agent  #1232).
• Prefer 'Repository' over 'Package' to describe PyPI and CRAN VMs
• Remove some FQDNs from DNS allowlist as this was too long for remote scripting
• Fixed SRE domain joining
• Switched package repositories to deploy into a permissive network (for Docker image download) before moving to their final location
• Ensured that user email addresses are synchronised with AzureAD

🌂 Related issues

Closes #738. Closes #742.

🔬 Tests

• Deploy an SHM
• Deploy a tier2 SRE
• Deploy a tier3 SRE

[jemrobinson]

In reference to #742, the current set of firewall rules give:

PS C:\Users\domaingreenadmin> Test-AzureADConnectHealthConnectivity -Role Sync
Test-AzureADConnectHealthConnectivity's execution in details are as follows:
Starting Test-AzureADConnectHealthConnectivity ...

Connectivity Test Step 1 of 3: Testing dependent service endpoints begins ...
AAD CDN connectivity is skipped.
Connecting to endpoint https://login.microsoftonline.com
Endpoint validation for https://login.microsoftonline.com is Successful.
Connecting to endpoint https://policykeyservice.dc.ad.msft.net/clientregistrationmanager.svc
Endpoint validation for https://policykeyservice.dc.ad.msft.net/clientregistrationmanager.svc is Successful.
Connecting to endpoint https://policykeyservice.dc.ad.msft.net/policymanager.svc
Endpoint validation for https://policykeyservice.dc.ad.msft.net/policymanager.svc is Successful.
Connectivity Test Step 1 of 3 - Testing dependent service endpoints completed successfully.

Connectivity Test Step 2 of 3 - Blob data upload procedure begins ...
MD5 setting CloudStorageAccount.UseV1MD5 = False
Tenant Id is successfully collected during agent registration.
Connectivity Test Step 2 of 3 - Blob data upload procedure completed successfully.

Connectivity Test Step 3 of 3 - EventHub data upload procedure begins ...
Tenant Id is successfully collected during agent registration.
Connectivity Test Step 3 of 3 - EventHub data upload procedure completed successfully.

Test-AzureADConnectHealthConnectivity completed successfully...

[JimMadge]

For reference, Ubuntu server docs on package management contains a discussion of configuring unattended-upgrades. Seems quite flexible.