Your enterprise runs security-sensitive CI/CD workflows on GitHub-hosted larger runners. The security team requires that all outbound traffic from these runners to your internal Azure resources travels over a private network without traversing the public internet, and that the runners receive IP addresses from your own Azure virtual network. As the enterprise administrator, what is the correct approach to meet this requirement?