Private networking improvements/fixes: AksNodeResourceGroupName, ResourceGraphClient, no AKS PublicNetworkAccess, LogAnalyticsArmId, existing role assignment

[Matt McLoughlin]

Adds AksNodeResourceGroupName as a new configuration setting
Fixes bug with AzureUSGovernment + private networking: ResourceGraphClient did not have a cloud BaseUrl set
Removes AKS PublicNetworkAccess via using the newer SDK property
Fixes bug when LogAnalyticsArmId is specified
Fixes bug when a role assignment is already assigned to the managed identity