Can't assign static IP address outside of the node resource group to a LoadBalancer service

I am trying to deploy the following `Service`, that should get a static IP address outside the node resource group assigned.

```yaml
apiVersion: v1
kind: Service
metadata:
creationTimestamp: null
labels:
app: micro-api
name: micro-api-static-ip
annotations:
service.beta.kubernetes.io/azure-load-balancer-resource-group: aro-demo-network
loadBalancerIp: 51.105.185.60
spec:
ports:
- port: 8080
protocol: TCP
targetPort: 8080
selector:
deploymentconfig: micro-api
type: LoadBalancer
status:
loadBalancer: {}
```

This results in the follwing error:

```bash
~ oc describe service/micro-api-static-ip
Name: micro-api-static-ip
Namespace: microcommunication
Labels: app=micro-api
Annotations: service.beta.kubernetes.io/azure-load-balancer-resource-group: aro-demo-network
Selector: deploymentconfig=micro-api
Type: LoadBalancer
IP: 172.30.240.21
Port: 8080/TCP
TargetPort: 8080/TCP
NodePort: 31536/TCP
Endpoints: 10.131.0.19:8080
Session Affinity: None
External Traffic Policy: Cluster
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal EnsuringLoadBalancer 4s (x2 over 9s) service-controller Ensuring load balancer
Warning CreatingLoadBalancerFailed 4s (x2 over 9s) service-controller Error creating load balancer (will retry): failed to ensure load balancer for service microcommunication/micro-api-static-ip: network.PublicIPAddressesClient#List: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client 'a632190a-ba6d-4773-9b37-b3ae769b47a9' with object id 'a632190a-ba6d-4773-9b37-b3ae769b47a9' does not have authorization to perform action 'Microsoft.Network/publicIPAddresses/read' over scope '/subscriptions/0ec6dbb0-b89b-4bb3-9140-14e3d244e0ee/resourceGroups/aro-demo-network/providers/Microsoft.Network' or the scope is invalid. If access was recently granted, please refresh your credentials."
```

When running the same service in AKS, the IP assignment works fine. We assumed, following the AKS logs would also apply for ARO: https://docs.microsoft.com/en-us/azure/aks/static-ip#use-a-static-ip-address-outside-of-the-node-resource-group

The Service principal, which ARO uses, has *Network Contributor* rights to the `aro-demo-network` resource group, wich contians the Public IP address, we want to assign.