docs: clarify folder scope requirements for service connection dependencies

[cdot65]

Overview

When creating a service connection, the IKE gateway and IPsec tunnel must exist in the "Service Connections" folder — not in user-facing folders like Texas. There's no guidance about this in CLI help text or docs, leading to confusing INVALID_REFERENCE errors.

Context

• deployment.py line 551 hardcodes "folder": "Service Connections" for service connections
• IKE gateways/IPsec tunnels created in other folders (e.g. --folder Texas) are invisible to service connections
• The error message ipsec-tunnel 'X' is not a valid reference doesn't hint at folder scope

Suggested Fix

• Add a note to docs/cli/deployment/service-connection.md explaining that referenced IKE gateways and IPsec tunnels must be in the Service Connections folder
• Consider adding a hint in the CLI error output when a reference fails

Acceptance Criteria

• Service connection docs explain folder scope for dependencies
• Best Practices section mentions creating IKE GW + IPsec tunnel in "Service Connections" folder