Defaults on certain Azure resources properties can be hard to change once enabled

## Description

For example, there are certain properties on resources that if are enabled, cannot be rolled back or changed after. Below is an example for a storage account :

```bicep
@description('Optional. A boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true.')
param requireInfrastructureEncryption bool = true
```

- Should we be setting/enforcing a property to true, if it is referenced as 'optional' in our template reference documentation?
- We need to have clear guidance on what 'Secure by default / design' means so that we can call out these features on our modules. This change for example caused issues with our existing storage accounts for the dependency pipeline where we now must delete our resources so we can redeploy with the new defaults

Error example:

```pwsh
~~~~~~~~~~~~~~~~~~~~
| 01:35:33 - The deployment
| 'storageAccounts-20220309T0103294582Z' failed with error(s).
| Showing 1 out of 1 error(s). Status Message: The property
| 'requireInfrastructureEncryption' was specified in the input,
| but it cannot be updated as it is read-only. For more
| information, see - https://aka.ms/storageaccountupdate
| (Code:AccountPropertyCannotBeUpdated) CorrelationId:
| 80271a0d-6011-444c-ba2d-14fe65af985f
```

### Steps to reproduce

1. Create a resource without a specific property that is enforced as a parameter default
2. Enforce this property with a default in the module
3. redeploy the same module again with the new change