feat: add idle Azure VPN Gateway detection

[jhayoncloud]

Summary

Adds support for detecting idle Azure VPN Gateways based on Azure Monitor bandwidth metrics.

Changes

• Added a new azure.idle_vpn_gateway source.
• Lists Azure VPN Gateways in the configured resource group.
• Queries the AverageBandwidth metric using hourly intervals over the configured lookback period.
• Calculates the average bandwidth across the lookback window.
• Fetches the live hourly VPN Gateway price from the Azure Retail Prices API using the gateway SKU and region.
• Added a SQL policy that identifies gateways with zero average bandwidth and calculates estimated monthly cost using 730 hours.
• Registered the new Azure source in the pipeline runner.
• Added a real Azure test pipeline configuration for the VPN Gateway detection flow.

Validation

• Tested against a real Azure VPN Gateway.
• Verified the Azure Monitor AverageBandwidth metric.
• Verified live Azure Retail Pricing lookup.
• Verified the source → DuckDB → SQL policy pipeline end-to-end.
• Full existing test suite passes: 50/50 tests.

Closes #12

[raphgm]

Verified: pulled the branch, ran all 50 existing tests locally, all pass (matches your claim). Independently confirmed the live pricing filter against the Retail Prices API for a real SKU (VpnGw1, eastus -> $0.19/hr, correct). Good detail on the az.cmd/az cross-platform handling for Windows — most existing checks in this repo don't bother with that. Closes #12 cleanly. Thanks for following up on the questions in the issue thread first before building this.

[jhayoncloud]

Thanks for reviewing and independently validating the implementation. I appreciate the feedback and the opportunity to contribute to the project!