[AVM Module Issue]: `avm/res/web/site` Assign roles to underlying storage account when `storageAccountUseIdentityAuthentication: true`

### Check for previous/existing GitHub issues

- [X] I have checked for previous/existing GitHub issues

### Issue Type?

Feature Request

### Module Name

avm/res/web/site

### (Optional) Module Version

_No response_

### Description

If you use identity to authenticate to the underlying storage account of the functionapp you require roleassignments to be done.

But when following the AVM patterns as is you will encounter a cycle of dependencies (The expression is involved in a cycle ("fn" -> "fnstg").bicep(BCP080))

As is would look something like this (which won't work)
```bicep
module fnstg 'br/public:avm/res/storage/storage-account:0.9.1' = { // Storage account for the function app backend (where the function app code is stored)
name: '${deployment().name}-functionStorage'
scope: resourceGroup(rgName)
dependsOn: [
rg
]
params: {
name: fnstgName
location: location
roleAssignments: [
{
principalId: fn.outputs.systemAssignedMIPrincipalId
roleDefinitionIdOrName: 'Storage Blob Data Owner'
}
{
principalId: fn.outputs.systemAssignedMIPrincipalId
roleDefinitionIdOrName: 'Storage Blob Queue Data Contributor'
}
{
principalId: fn.outputs.systemAssignedMIPrincipalId
roleDefinitionIdOrName: 'Storage Account Contributor'
}
]
}
}

module fn 'br/public:avm/res/web/site:0.3.9' = { // Function app which will run the python code
name: '${deployment().name}-function'
scope: resourceGroup(rgName)
dependsOn: [
rg
asp
fnstg
]
params: {
name: fnName
location: location
kind: 'functionapp,linux'
serverFarmResourceId: asp.outputs.resourceId
siteConfig: {
pythonVersion: '3.11'
linuxFxVersion: 'python|3.11'
}
appSettingsKeyValuePairs: {
FUNCTIONS_WORKER_RUNTIME: 'python'
FUNCTIONS_EXTENSION_VERSION: '~4'
WEBSITE_RUN_FROM_PACKAGE: '1' // Required to be able to deploy from a package
}
managedIdentities: {
systemAssigned: true // Creates a managed identity for the function app to access other azure resources
}
storageAccountResourceId: fnstg.outputs.resourceId
storageAccountUseIdentityAuthentication: true // Required to be able to access the storage account without access keys
}
}
```

You could work around by creating seperate role assignment resource depending on these two and call the fnstg as existing resource for the scope of the resource roleassignment, but I think this could be done better in the web/site module.

**Proposed solution**
When `storageAccountUseIdentityAuthentication: true` and `!empty(storageAccountResourceId)` these 3 roleassignments should be created in the module

### (Optional) Correlation Id

_No response_