Enable NSGs shared between multiple machines

[aiyengar2]

This PR allows users of the Azure driver to submit an NSG name or ARM resource identifier to be used by multiple machines that are provisioned via Rancher Machine. If a user does not submit an NSG name, machine will default to the legacy option of creating an NSG per machine.

Related Issues: rancher/rancher#25342, rancher/rancher#11674, rancher/rancher#17181, rancher/rancher#22147, rancher/rancher#24449

[aiyengar2]

A point of consideration for pooled NSGs in this commit:

In the pooled NSG case, we currently create one network interface per NSG and attach the network interface to the NSG referenced by the driver flag. As a result, when we have x nodes spun up in our node pool, there are x network interfaces (all part of the same subnet) that are attached to the single network security group.

An alternative to this design would be to have the one NSG attached directly to the subnet, as suggested in rancher/rancher#17181 and rancher/rancher#11674. However, I chose not to include that design due to the following two edge cases:

1. Two node templates sharing the same subnet will be forced to share the same NSG / open port values.
2. Cleanup logic (detailed here: https://github.com/rancher/machine/blob/master/drivers/azure/azure.go#L462-L480) currently deletes network security groups before deleting the subnet. Therefore, when cleaning up the network security group, it would not be clear whether the network security group is still in use by other nodes (as we haven't attempted to clean up the subnet yet) or this is the last node to be deleted. So to facilitate this logic, it would require a rewrite in the way we handle cleanup logic for nodes, which could have unintended consequences with legacy versions of machine currently running.

Would love to hear if there are any opposing opinions / suggested improvements for this design!

[aiyengar2]

This PR should resolve the following issues:

• Azure node driver fixes rancher#25342 (milestone 4 / 4i / 4ii regarding NSGs)
• Rancher 2.0 RKE on Azure create 1 NSG per VM rancher#11674
• Azure cloud provider does not correctly configure firewall rancher#17181
• Azure LoadBalancer not working when using more than 1 node cluster rancher#22147

[aiyengar2]

PR has been simplified based on clarified requirements from #77 (comment) and is ready for re-review!

Double checked that the expected use cases provision correctly:

• Creating 1 NSG per node when d.NSG is not specified / is empty (legacy)
• Creating 1 NSG per pool when d.NSG is specified and is not an ARM resource identifier (new default)
• Using an existing NSG when provided in the ARM resource identifier format
• Creating a second node in the legacy case with an updated node template creates a brand new NSG with the updated rules. The older node's NSG is not updated, as expected.
• Creating a second node in the pooled case with an updated node template attaches itself to the pooled NSG and updates the rules accordingly.

[deniseschannon]

rancher/rancher#24449