GPU driver DINE policy assignment fails remediation: system-assigned identity granted no role (roleDefinitionIds not passed to policy-assignment module)

### What happened? Provide a clear and concise description of the bug, including deployment details.

### Describe the bug

The GPU driver policy assignment module creates a policy assignment with a
system-assigned managed identity, but never grants that identity any role.
As a result, the DeployIfNotExists (DINE) remediation task fails because its
identity has no permission to create the remediation deployment.

Affected module: `workload/bicep/modules/azurePolicies/gpuExtensionsSubscriptions.bicep`

### Error

Remediation (and the manually triggered remediation task) fails with:

> Evaluation of DeployIfNotExists policy was unsuccessful. The policy assignment
> '.../policyAssignments/' resource identity does not have
> the necessary permissions to create deployment '.../deployments/PolicyDeployment_'.
> Please see https://aka.ms/arm-policy-identity for usage details.

### Root cause

The `gpuPolicyAssignmentsCompute` module invocation passes `identity: 'SystemAssigned'`
but does **not** pass `roleDefinitionIds`:

```bicep
module gpuPolicyAssignmentsCompute '../../../../avm/1.0.0/ptn/authorization/policy-assignment/modules/resource-group.bicep' = [for (customPolicyDefinition, i) in varCustomPolicyDefinitions: {
scope: resourceGroup('${subscriptionId}', '${computeObjectsRgName}')
name: 'Policy-Assign-${customPolicyDefinition.deploymentName}-${time}'
params: {
name: customPolicyDefinition.libDefinition.name
displayName: customPolicyDefinition.libDefinition.properties.displayName
description: customPolicyDefinition.libDefinition.properties.description
identity: 'SystemAssigned'
location: location
policyDefinitionId: gpuPolicyDefinitions[i].outputs.resourceId
// roleDefinitionIds NOT passed
}
}]

### Steps to reproduce
Deploy the GPU extension policies via gpuExtensionsSubscriptions.bicep (the Bicep/AVM path, not the portal).
Deploy (or already have) a matching GPU session-host VM in the target resource group.
Let the DINE policy evaluate, or run the remediation task manually.
Remediation fails with the "resource identity does not have the necessary permissions to create deployment" error above.

### Expected behavior
The policy assignment's system-assigned identity should automatically receive the
role(s) the policy definition requires, scoped to the target resource group, so the
remediation task succeeds without a manual role-assignment step.

### Proposed fix
Pass the role IDs from the policy definition straight through to the assignment
module, keeping declared and granted roles in sync:

policyDefinitionId: gpuPolicyDefinitions[i].outputs.resourceId
roleDefinitionIds: customPolicyDefinition.libDefinition.properties.policyRule.then.details.roleDefinitionIds
(The AMD and NVIDIA definitions currently declare Contributor. Consider narrowing
these to Virtual Machine Contributor — 9980e02c-c2be-4d73-94e8-173b1dc7cf3c —
since the remediation only writes a Microsoft.Compute/virtualMachines/extensions
resource and creates its deployment; Contributor is broader than required.)

### Please provide the correlation id associated with your error or bug.

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

### What was the expected outcome?

_No response_

### Relevant log output

```Shell

```

Start in workload/bicep/modules/azurePolicies/gpuExtensionsSubscriptions.bicep and inspect the gpuPolicyAssignmentsCompute module invocation alongside the policy definition roleDefinitionIds. Deploy the GPU extension policies through the Bicep/AVM path, then run or observe remediation. Done means the system-assigned identity receives the declared role and the DINE remediation succeeds without manual role assignment.

Written by the indexing model from the issue text.