after upgrading to 6.0.0 terraform plan continually wants to update landing zones policy assignment config for Enforce-GR-KeyVault

### Community Note

- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

### Versions

**terraform**: 1.9.2

**azure provider**: 3.111.0

**module**: 6.0.0

### Description

#### Describe the bug

after upgrading to 6.0.0 terraform plan continually wants to update landing zones policy assignment config for Enforce-GR-KeyVault

```
Terraform will perform the following actions:

# module.azure_landing_zone.module.core.module.alz.azurerm_management_group_policy_assignment.enterprise_scale["/providers/Microsoft.Management/managementGroups/ct-landing-zones/providers/Microsoft.Authorization/policyAssignments/Enforce-GR-KeyVault"] will be updated in-place
~ resource "azurerm_management_group_policy_assignment" "enterprise_scale" {
id = "/providers/Microsoft.Management/managementGroups/ct-landing-zones/providers/Microsoft.Authorization/policyAssignments/Enforce-GR-KeyVault"
name = "Enforce-GR-KeyVault"
- parameters = jsonencode({})
# (8 unchanged attributes hidden)

# (1 unchanged block hidden)
}

Plan: 0 to add, 1 to change, 0 to destroy.

```

Apply succeeds just fine, but next plan produces same results

#### Steps to Reproduce

my deployment is the level 300 - (seperate submodules for each of core, connectivity and management components)

core module code:

```
module "alz" {
# To enable correct testing of our examples, we must source this
# module locally. Please remove the local `source = "../../../../"`
# and uncomment the remote `source` and `version` below.
# source = "../../../../"
source = "Azure/caf-enterprise-scale/azurerm"
version = "6.0.0" # change this to your desired version, https://www.terraform.io/language/expressions/version-constraints

providers = {
azurerm = azurerm
azurerm.connectivity = azurerm
azurerm.management = azurerm
}

# Base module configuration settings
root_parent_id = data.azurerm_client_config.current.tenant_id
root_id = var.root_id
root_name = var.root_name
library_path = "${path.module}/lib"
default_location = "southafricanorth"

# Enable creation of the core management group hierarchy
# and additional custom_landing_zones
deploy_core_landing_zones = true
custom_landing_zones = local.custom_landing_zones
archetype_config_overrides = local.archetype_config_overrides

# Configuration settings for identity resources is
# bundled with core as no resources are actually created
# for the identity subscription
deploy_identity_resources = true
configure_identity_resources = local.configure_identity_resources
subscription_id_identity = var.subscription_id_identity

# The following inputs ensure that managed parameters are
# configured correctly for policies relating to connectivity
# resources created by the connectivity module instance and
# to map the subscription to the correct management group,
# but no resources are created by this module instance
deploy_connectivity_resources = false
configure_connectivity_resources = var.configure_connectivity_resources
subscription_id_connectivity = var.subscription_id_connectivity

# The following inputs ensure that managed parameters are
# configured correctly for policies relating to management
# resources created by the management module instance and
# to map the subscription to the correct management group,
# but no resources are created by this module instance
deploy_management_resources = false
configure_management_resources = var.configure_management_resources
subscription_id_management = var.subscription_id_management
strict_subscription_association = var.strict_subscription_association

}
```

#### Screenshots

#### Additional context

the change appears to not be doing anything so nothing appears to be broken
it wants to delete a block that is basically empty anyway

```
parameters = jsonencode({})
```

Start with the Azure/caf-enterprise-scale/azurerm module at version 6.0.0 and reproduce the reported Terraform plan for the Enforce-GR-KeyVault policy assignment. Inspect how its policy assignment parameters are configured, then verify that applying the configuration no longer produces the same update on the next plan.

Written by the indexing model from the issue text.