[AVM Module Issue]: avm/res/azure-stack-hci/cluster - OIDC exception required

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Issue Type?

Bug

### Module Name

avm/res/azure-stack-hci/cluster

### (Optional) Module Version

0.4.0

### Description

## Bug: Azure Stack HCI Cluster Module Requires OIDC Exception and Has Non-Idempotent deploymentSettings

### Summary

The `avm/res/azure-stack-hci/cluster` module has two interrelated CI/CD issues:

1. **OIDC Exception**: The module is currently on the OIDC exception list, requiring service principal + secret authentication instead of the standard OIDC flow used by all other AVM modules
2. **Non-Idempotent `deploymentSettings`**: The `Microsoft.AzureStackHCI/clusters/deploymentSettings` resource does not support idempotent re-deployment. Once it enters `DeploymentFailed` state, no further operations are allowed — the only recovery is to delete the entire cluster resource and start over

### Issue 1: OIDC Exception

The module is listed in the [OIDC exception list](https://github.com/Azure/bicep-registry-modules/blob/main/.github/actions/templates/avm-validateModuleDeployment/action.yml) in the deployment validation action:

```yaml
$exceptionModulePaths = @(
'avm/res/azure-stack-hci/cluster' # Failing on resource deletion when trying to delete RBAC at subscription level
'avm/res/azure-stack-hci/logical-network'
'avm/res/azure-stack-hci/network-interface'
'avm/res/azure-stack-hci/virtual-hard-disk'
'avm/res/azure-stack-hci/virtual-machine-instance'
...
)
```

**Root cause**: The module creates subscription-level role assignments during deployment (Contributor, Reader, RBAC Admin). During cleanup, the OIDC-based identity may lack permissions to delete these subscription-scoped assignments, causing the removal step to fail and leaving orphaned resources.

**Impact**: Requires maintaining a service principal with secret rotation, adds operational overhead, and diverges from the standard AVM CI authentication pattern.

### Requested Changes

#### For OIDC Exception
1. Investigate why OIDC-authenticated identities fail on subscription-level RBAC cleanup for HCI modules

### Environment

- Azure region: `southeastasia`
- API version: `2025-10-01` (`Microsoft.AzureStackHCI/clusters/deploymentSettings`)
- Module version: `0.4.0`
- Host VM: `Standard_E32bds_v5` with 2-node nested HCI cluster
- HCI OS: `AzureStackHCI23H2.25398.469`

---
avm.res.azure-stack-hci.cluster · Azure/bicep-registry-modules@7e56640

**can we rotate the client secret key for Service Principal used by this pipeline ?**

ERROR: AADSTS7000222: The provided client secret keys for app '***' are expired. Visit the Azure portal to create new keys for your app