[BUG] Traffic Analytics enablement on Flow Logs fails when Azure Policy requires tags on resources (TARequestDisallowedByPolicy)

### API Spec link

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/network/resource-manager/Microsoft.Network/stable/2025-01-01/networkWatcher.json

### API Spec version

2025-01-01

### Describe the bug

When creating or updating a Network Watcher Flow Log with Traffic Analytics enabled, if an Azure Policy with "Require a tag on resources" (built-in policy definition 871b6d14-10aa-478d-b590-94f262ecfa99) is assigned to the scope, the operation fails with error code TARequestDisallowedByPolicy, even though the Flow Log resource itself has all required tags set.

The Flow Log creation itself succeeds (the resource gets created with tags), but the Traffic Analytics enablement step fails due to the policy restriction. This suggests the Traffic Analytics enablement process does not properly account for tag policies.

### Expected behavior

Creating a Flow Log with Traffic Analytics enabled should succeed when the Flow Log resource includes all required tags in the request body.

### Actual behavior

The Flow Log creation/update fails with the following error:

```
Status: "TARequestDisallowedByPolicy"
Code: ""
Message: "The enablement of Traffic Analytics is blocked due to the user's policy restrictions:
\"RequestDisallowedByPolicy, Policy Definition ID: /providers/Microsoft.Authorization/policyDefinitions/871b6d14-10aa-478d-b590-94f262ecfa99
Policy Assignment ID: /subscriptions//resourceGroups//providers/Microsoft.Authorization/policyAssignments/require-environment-tag\""
```

### Reproduction Steps

- Create a Resource Group with an Environment tag
- Assign the built-in policy "Require a tag on resources" (871b6d14-10aa-478d-b590-94f262ecfa99) with tagName = "Environment" and effect Deny to the resource group
- Create a Virtual Network, Storage Account, Log Analytics Workspace, and Network Watcher — all with the Environment tag
- Create a Flow Log targeting the VNet with Traffic Analytics enabled, pointing to the Log Analytics Workspace, and include the Environment tag on the Flow Log itself
- The operation fails with TARequestDisallowedByPolicy

### Environment

Terraform, API

Start with specification/network/resource-manager/Microsoft.Network/stable/2025-01-01/networkWatcher.json and review the Flow Log operations and Traffic Analytics fields against the reported request. Reproduce the policy-denied enablement using the listed Azure resources and tags, then determine whether the API specification is inaccurate or the behavior belongs to the service. Done means the required specification change or service-owner conclusion is documented.

Written by the indexing model from the issue text.