Feature: Improve RequestDisallowedByPolicy error message

In below example, the storage account is disallowed by the policy because of the policy "Deny Storage Account Creation with Anonymous Access".

In the error message, it mentioned "properties.allowBlobPublicAccess" which is an ARM resource path, but it's quite different from the definition in azurerm config: `allow_nested_items_to_be_public`.

It could be more user friendly if the error message targets the azurerm provider schema.

```bash
NFO[0000] terraform executable path: /opt/homebrew/bin/terraform
INFO[0000] reading terraform plan file: ./planfile
INFO[0001] generating request body...
INFO[0002] azurerm_resource_group.example: success
INFO[0002] azurerm_storage_account.test: success
INFO[0002] total terraform resources: 2, success: 2, failed: 0
INFO[0002] sending preflight request...
INFO[0007] preflight errors: 1
ERRO[0007] address: azurerm_storage_account.test, error: POST https://management.azure.com/providers/Microsoft.Resources/validateResources
--------------------------------------------------------------------------------
RESPONSE 400: 400 Bad Request
ERROR CODE: ResourceValidationFailed
--------------------------------------------------------------------------------
{
"error": {
"code": "ResourceValidationFailed",
"message": "Resource validation failed, correlation id: '15379fe8-d90b-4e4d-8934-c3e4698e5364', see details for more information.",
"details": [
{
"code": "RequestDisallowedByPolicy",
"target": "henglu224",
"message": "Resource 'henglu224' was disallowed by policy. Policy identifiers: '[{\"policyAssignment\":{\"name\":\"[AzCliTools][SFI-TI2.3.3] Deny Storage Account Creation with Anonymous Access\",\"id\":\"/subscriptions/0000/providers/Microsoft.Authorization/policyAssignments/5712913d870246df83e718b5\"},\"policyDefinition\":{\"name\":\"[AzCliTools][SFI-TI2.3.3] Deny Storage Account Creation with Anonymous Access\",\"id\":\"/subscriptions/0000/providers/Microsoft.Authorization/policyDefinitions/[AzCliTools][SFI-TI2.3.3]\",\"version\":\"1.0.0\"}}]'.",
"additionalInfo": [
{
"type": "PolicyViolation",
"info": {
"evaluationDetails": {
"evaluatedExpressions": [
{
"result": "True",
"expressionKind": "Field",
"expression": "type",
"path": "type",
"expressionValue": "Microsoft.Storage/storageAccounts",
"targetValue": "Microsoft.Storage/storageAccounts",
"operator": "Equals"
},
{
"result": "True",
"expressionKind": "Field",
"expression": "Microsoft.Storage/storageAccounts/allowBlobPublicAccess",
"path": "properties.allowBlobPublicAccess",
"expressionValue": true,
"targetValue": "True",
"operator": "Equals"
},
{
"result": "False",
"expressionKind": "Value",
"expression": "[resourceGroup().name]",
"expressionValue": "henglu224",
"targetValue": "rg-sfi-*",
"operator": "Like"
},
{
"result": "False",
"expressionKind": "Value",
"expression": "[resourceGroup().name]",
"expressionValue": "henglu224",
"targetValue": "acctest*",
"operator": "Like"
}
]
},
"policyDefinitionId": "/subscriptions/0000/providers/Microsoft.Authorization/policyDefinitions/[AzCliTools][SFI-TI2.3.3]",
"policyDefinitionName": "[AzCliTools][SFI-TI2.3.3]",
"policyDefinitionDisplayName": "[AzCliTools][SFI-TI2.3.3] Deny Storage Account Creation with Anonymous Access",
"policyDefinitionVersion": "1.0.0",
"policyDefinitionEffect": "deny",
"policyAssignmentId": "/subscriptions/0000/providers/Microsoft.Authorization/policyAssignments/5712913d870246df83e718b5",
"policyAssignmentName": "5712913d870246df83e718b5",
"policyAssignmentDisplayName": "[AzCliTools][SFI-TI2.3.3] Deny Storage Account Creation with Anonymous Access",
"policyAssignmentScope": "/subscriptions/0000",
"policyAssignmentParameters": {},
"policyExemptionIds": [],
"policyEnrollmentIds": []
}
}
]
}
]
}
}
--------------------------------------------------------------------------------

INFO[0007] sending policy request...
INFO[0010] check policy restrictions passed
```

No file or test is named. Start by locating the handling of RequestDisallowedByPolicy and the code that reports evaluated policy paths; trace how properties.allowBlobPublicAccess is surfaced and where azurerm schema names could be associated. Done means the error identifies the provider-facing allow_nested_items_to_be_public setting and the relevant tests pass.

Written by the indexing model from the issue text.