[Gallery Image Versions - Update] can't scale up replicas when there is an Azure Policy requiring disk encryption set

This is a [customer reported issue](https://portal.microsofticm.com/imp/v5/incidents/details/654511499/summary).

Sample command that is used to scale up replicas of GalleryImageVersion resource:
`az sig image-version update --resource-group acgtest --gallery-name acgrt --gallery-image-definition dew --gallery-image-version 2.0.0 --target-regions uksouth=2`

When an [Azure Policy](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/OSAndDataDiskCMKRequired_Deny.json) requiring disk encryption sets is applied, this update command fails on GalleryImageVersion resources already utilizing a disk encryption set.
```
error: {

code: 'RequestDisallowedByPolicy',

target: '22631.5476.250610',

message: 'Resource '22631.5476.250610' was disallowed by policy. Policy identifiers: '[{\\'policyAssignment\\':{\\'name\\':\\'Ensure secure-by-default azurediskstorage for Financial Services Industry\\',\\'id\\':\\'/providers/Microsoft.Management/managementGroups/ace-alpha-01-landingzones/providers/Microsoft.Authorization/policyAssignments/APF-Compliant-AzDisk\\'},\\'policyDefinition\\':{\\'name\\':\\'OS and data disks should be encrypted with a customer-managed key\\',\\'id\\':\\'/providers/Microsoft.Authorization/policyDefinitions/702dd420-7fcc-42c5-afe8-4026edd20fe0\\',\\'version\\':\\'3.0.0\\'},\\'policySetDefinition\\':{\\'name\\':\\'Ensure secure-by-default azurediskstorage for Financial Services Industry\\',\\'id\\':\\'/providers/Microsoft.Management/managementGroups/ace-alpha-575Lab-01/providers/Microsoft.Authorization/policySetDefinitions/APF-Compliant-AzDisk\\',\\'version\\':\\'1.0.0\\'}}]'.',
```

This policy is enforced at the ARM level - meaning the API call does not make it to the Compute RP.

Proposed fix:
1. If the GalleryImageVersion resource has a disk encryption set and the `az sig image-version update` is used, CLI client should do a GET GalleryImageVersion call and merge disk encryption set payload for the region into the PATCH request.
2. `az sig image-version update` should take `[--target-region-encryption]` as input so the customer can pass the same disk encryption set for updates