Public endpoint PaaS policy validation fails when moving keyvaults to another subscription

### Community Note

- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

### Versions

**terraform**: > 1.7

**azure provider**: > 4.1.0 azurerm (v4.31.0)

**module**: 6.2.1

### Description

#### Describe the bug

When creating a keyvault with public access disabled and private endpoint passes validation policies without issues, the keyvault correctly shows public network access disabled and there is a private endpoint that we can access privaterly. When trying to move the keyvault to another subscription we get failed validation (Code: ResourceMovePolicyValidationFailed) as below :

```json
{
"message": "Resource move policy validation failed. Please see details. Diagnostic information: subscription id 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxx', request correlation id 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxx'. (Code: ResourceMovePolicyValidationFailed) Resource 'kv-dev-cloud' was disallowed by policy. Policy identifiers: '[{\"policyAssignment\":{\"name\":\"Public network access should be disabled for PaaS services\",\"id\":\"/providers/Microsoft.Management/managementGroups/prod-corp/providers/Microsoft.Authorization/policyAssignments/Deny-Public-Endpoints\"},\"policyDefinition\":{\"name\":\"Azure Key Vault should disable public network access\",\"id\":\"/providers/Microsoft.Authorization/policyDefinitions/405c5871-3e91-4644-8a63-58e19d68ff5b\",\"version\":\"1.1.0\"},\"policySetDefinition\":{\"name\":\"Public network access should be disabled for PaaS services\",\"id\":\"/providers/Microsoft.Management/managementGroups/prod/providers/Microsoft.Authorization/policySetDefinitions/Deny-PublicPaaSEndpoints\",\"version\":\"1.0.0\"}}]'. (Code: RequestDisallowedByPolicy, Target: kv-dev-cloud)",
"code": "ResourceMovePolicyValidationFailed",
"name": "BatchResponseItemError",
"stack": "BatchResponseItemError: Resource move policy validation failed. Please see details. Diagnostic information: subscription id 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxx', request correlation id 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxx'.\n at t (https://portal.azure.com/Content/Dynamic/MYbNINXhLuLV.js:41:815)\n at new t (https://portal.azure.com/Content/Dynamic/MYbNINXhLuLV.js:61:11960)\n at https://portal.azure.com/Content/Dynamic/MYbNINXhLuLV.js:61:4965\n at Array.forEach ()\n at https://portal.azure.com/Content/Dynamic/MYbNINXhLuLV.js:61:3220",
"status": 409
}

```

seems to be related to `Azure Key Vault should disable public network ` `/providers/Microsoft.Authorization/policyDefinitions/405c5871-3e91-4644-8a63-58e19d68ff5b` within `Public network access should be disabled for PaaS services` `/providers/Microsoft.Management/managementGroups/prod/providers/Microsoft.Authorization/policySetDefinitions/Deny-PublicPaaSEndpoints`

There is no public IP on the KV or the private interface (network interface)

#### Steps to Reproduce

1. create keyvault with public access disabled + private endpoint
2. try to move kv to another subscription
3. you get the error mentioned above

#### Screenshots



#### Additional context

Start with the three reproduction steps in the issue and inspect the Azure Key Vault move validation behavior for the named policy definition 405c5871-3e91-4644-8a63-58e19d68ff5b and policy set Deny-PublicPaaSEndpoints. Compare a private-endpoint Key Vault with public access disabled before and after a subscription move. Done means determining whether the landing-zone configuration contributes to the failure and recording a verified resolution or limitation.

Written by the indexing model from the issue text.