fix(azure-arg): real resourceGroup/location on non-compute rows + strip internal tags

[NitinKumar004]

Problem (A1)

Azure Resource Graph (Microsoft.ResourceGraph/resources), the generic resource-list, and exportTemplate reported the wrong resourceGroup and location for non-compute Azure resources:

• services/resourcediscovery/arn.go built every non-compute Azure ARN with the literal azureDefaultResourceGroup = "default", so rows rendered resourceGroup: "default" regardless of where the resource actually lived.
• The walkers in services/resourcediscovery/walkers.go hardcoded Region: e.region (the engine default, us-east-1) for those same resources, so Azure rows rendered an AWS-style location: "us-east-1".
• The internal ARM tag cloudemu:azureName (and the other cloudemu:* bookkeeping tags) leaked onto Azure rows — they were never stripped by the wire renderers.

Compute VMs (inst.ResourceGroup/inst.Region) and storage buckets (b.Region) already threaded real values; the other types did not.

Fix

Thread the real per-resource resource group and region into the Azure rows, mirroring compute VMs, reading from where each type actually stores them:

• Networking — resource group from the ARM tags the wire handlers stamp (cloudemu:azure*ResourceGroup); region from the AzureNetworkMetadata type-asserted capability (GetAzureVNetMetadata/GetAzureNSGMetadata/GetAzureRouteTableMetadata) for VNet / NSG / route table.
• Storage & Database (Cosmos) — resource group and region from the existing BucketAttributes / TableAttributes projections (AccountAttributes.ResourceGroup/.Location).
• Volumes (managed disks) — resource group from the disk ARM tag; region from VolumeInfo.Location. Snapshots get the resource group from their ARM tag.
• The *ARN builders now take a resourceGroup argument; the Azure branch folds it into the id, the AWS/GCP branches ignore it.
• Internal-tag stripping — added StripInternalTags in server/azure/resourcegraph and applied it in resourceToWire (ARG + generic resource-list) and the resource-group exportTemplate path, so cloudemu:* tags never leak while real user tags are preserved.

Left as-is (region not persisted by the emulator, noted for follow-up)

Public IP, NAT gateway, subnet, network interface, snapshot, serverless function and monitoring-alarm rows keep the engine region for location — those types do not store a per-resource region anywhere the walker can reach (the Azure wire handlers themselves fall back to defaultLoc for public IP). Their resource group is still fixed where an ARM tag exists (public IP / NAT gateway / snapshot). Faking a region was explicitly avoided.

Blast radius — AWS/GCP unaffected

Every change is Azure-scoped or provider-gated: azureRGFromTags returns "" for non-Azure providers, azureNetLocation returns e.region when the AzureNetworkMetadata capability is absent (AWS/GCP fail the type assertion), the AWS/GCP *ARN branches ignore the new resourceGroup argument, and StripInternalTags only removes the cloudemu: prefix that no AWS/GCP tag carries.

Verified green (byte-unchanged behavior):

• server/aws/resourceexplorer2, server/aws/resourcegroupstaggingapi, server/aws/configservice
• server/gcp/cloudasset
• full ./server/aws/... and ./server/gcp/... suites

Test

Added server/azure/resourcegraph/azure_row_correctness_test.go: a real-SDK test that creates a VNet (via the live armnetwork client) under rg-prod/westus2 and a VM (via armcompute), then queries through the live armresourcegraph client and asserts the VNet row reports resourceGroup: "rg-prod" and location: "westus2" (not default/us-east-1), its id embeds the real group, and neither the VNet nor the VM row carries any cloudemu:* tag while the real env=prod user tag survives.

Gates

• go build ./... — clean
• go test ./services/resourcediscovery/... ./server/azure/resourcegraph/... ./server/azure/resourcegroups/... and all three providers' discovery paths — green
• golangci-lint run ./services/resourcediscovery/... ./server/azure/resourcegraph/... — zero new issues (baseline pre-existing issues unchanged)