Don't use Nexus for T0/T1

[JimMadge]

✅ Checklist

• I have searched open and closed issues for duplicates.
• This is a request for a new feature in the Data Safe Haven or an upgrade to an existing feature.
• The feature is still missing in the latest version.
• I have read through the documentation.
• This isn't an open-ended question (open a discussion if it is).

🍓 Suggested change

T0/T1 instance have unfiltered outbound internet access, so there is no need for the Nexus proxies for PyPI/CRAN. It could provide some caching, but it probably isn't worth it.

We could not deploy the Nexus container group and not template the /etc/pip.conf and /etc/RProfile files for these tiers.

• Software repository deployment should be based on allow_workspace_internet - if it is allowed, there is no need for repositories
• Catch incompatible config parameters - if allow_workspace_internet is true, then all software packages should be allowed
• Desired state should either template the pip or R config files differently or don't template them at all
• Modify allowlist functions to catch situations where there are no allowlists
• Ensure software repository related outputs from user services are handled correctly when there are no software repositories.