Get-AzRoleAssignment: cannot get/manage roleassignments for subscription scoped resources

### Description

Currently all AzRoleAssignment cmdlets are limiting access to only ManagementGroup, Subscription and ResourceGroup, Resources and Subresources roleAssignments.

But there are resources on a Subscription scoped eg. RestorableDatabaseAccounts from CosmosDB. The only way to manage them is to use az cli instead of Powershell cmdlets.

### Issue script & Debug output

```PowerShell
Get-AzRoleAssignment -Scope /subscriptions/xxxxxxxxx/providers/Microsoft.DocumentDB/locations/northeurope/restorableDatabaseAccounts/xxxxxxxxx
Get-AzRoleAssignment: Scope '/subscriptions/xxxxxxxxx/providers/Microsoft.DocumentDB/locations/northeurope/restorableDatabaseAccounts/xxxxxxxxx' should begin with '/subscriptions//resourceGroups'.
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 7.5.4
PSEdition Core
GitCommitId 7.5.4
OS Darwin 25.2.0 Darwin Kernel Version 25.2.0: Tue Nov 18 21:09:40 PST 2025; root:xnu-12377.61.12~1/RELEASE_ARM64_T6000
Platform Unix
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 5.3.2 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script 7.1.0 Az.Aks {Disable-AzAksAddOn, Enable-AzAksAddOn, Get-AzAksCluster, Get-AzAksNodePool…}
Script 1.19.1 Az.CosmosDB {Add-AzCosmosDBFleetspaceAccount, Get-AzCosmosDBAccount, Get-AzCosmosDBAccountKey, Get-Az…
Script 1.2.1 Az.ResourceGraph {Search-AzGraph, Get-AzResourceGraphQuery, New-AzResourceGraphQuery, Remove-AzResourceGra…
Script 9.0.0 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}
```

### Error output

```PowerShell
Message : Scope '/subscriptions/xxxxxxxxx/providers/Microsoft.DocumentDB/locations/northeurope/restorableDatabaseAccounts/xxxxxxxxx' should begin with '/subscriptions//resourceGroups'.
StackTrace : at Microsoft.Azure.Commands.Resources.Models.Authorization.AuthorizationClient.ValidateScope(String scope, Boolean allowEmpty)
at Microsoft.Azure.Commands.Resources.GetAzureRoleAssignmentCommand.ExecuteCmdlet()
at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
Exception : System.ArgumentException
InvocationInfo : {Get-AzRoleAssignment}
Line : Get-AzRoleAssignment -Scope /subscriptions/xxxxxxxxx/providers/Microsoft.DocumentDB/locations/northeurope/restorabl
eDatabaseAccounts/xxxxxxxxx
Position : At line:1 char:1
+ Get-AzRoleAssignment -Scope /subscriptions/xxxxxxxxx …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId : 203
```