feat(finops-hub): Add sovereign cloud support

[MSBrett]

Summary

Adds sovereign cloud support to FinOps Hubs, enabling deployment to Azure US Government, Azure China (21Vianet), and other sovereign environments.

Changes

Bicep template changes (src/templates/finops-hub/)

• Kusto DNS suffix: Replace hardcoded .kusto.windows.net with an environment-aware lookup map covering AzureCloud, AzureUSGovernment, and AzureChinaCloud, with a replace() fallback heuristic for unknown clouds. Fixes an incorrect China suffix (kusto.chinacloudapi.cn → kusto.windows.cn).
• Open data URL: Add openDataBaseUrl parameter (threaded through main.bicep → hub.bicep → Analytics/app.bicep) so sovereign environments without internet access can point to a local storage account instead of GitHub.
• Conditional ADF resources: Automatically skip ADF GitHub linked service and dataset when openDataBaseUrl points to the hub's own storage account.
• Storage URL validation: Update createUiDefinition.json regex to accept storage suffixes from all clouds (not just .windows.net).
• Dashboard portal links: Replace 27 hardcoded portal.azure.com URLs in dashboard.json with a build-time $$defined-portal-url$$ token.
• Dashboard cluster URI: Clear the hardcoded clusterUri — users configure it to their cluster after import.
• Build script: Add -PortalUrl parameter to Build-Toolkit.ps1 (defaults to https://portal.azure.com).
• Bug fix: Fix gitapp.hub.com typo in ADF linked service URL → github.com.

Documentation (docs-mslearn/toolkit/hubs/)

• deploy-sovereign.md: New Microsoft Learn how-to guide covering build, open-data preparation, deployment, and dashboard configuration for sovereign clouds. Follows deploy.md conventions (front matter, tab selectors, admonitions, related content).

Testing

• Bicep compiles clean (bicep build main.bicep)
• JSON validity verified
• Grep verification: no hardcoded .kusto.windows.net, portal.azure.com, logic.azure.com, or gitapp.hub.com in changed files
• Red-team audit: all DNS suffix claims verified against Azure Private Link DNS zone docs
• Blue-team validation: all code assertions verified against repo files
• ❎ Log not needed

Checklist

• Bicep changes scoped to src/templates/finops-hub/ only
• No changes to PowerShell module, Optimization Engine, or other templates
• Documentation follows Microsoft style guide (sentence casing, active voice, no end punctuation on headings)
• deploy-sovereign.md matches deploy.md format conventions