Create private endpoint for the `dfs` endpoint of the storage account

[SvenAelterman]

Currently, the secured (private) storage account in the research enclave only has a private endpoint for the blob endpoint enabled. To enable accessing the storage account using tools that support the ADLS Gen 2 protocols, the dfs endpoint also needs a private endpoint.

This involves creating a new private endpoint and a new private DNS zone. Currently, these resources are created in the storage_account.bicep file, but if multiple resources of those types will be created, they should be abstracted in modules.