And then in the locals create a new list of the vnet links to create per zone, per network and pass that on to the avm-res-network-privatednszone module that already accepts that configuration.

I get the Route configuration error below for the App Gateway, which we can fix by setting the Route to null for AppGatewaySubnet in the file locals.netrworking.tf ...