[AVM Module Issue]: event-grid/system-topic externalResourceRoleAssignments fails for cross-resource-group destinations (ResourceNotFound)

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Issue Type?

Bug

### Module Name

avm/res/event-grid/system-topic

### (Optional) Module Version

0.6.5

### Description

When `externalResourceRoleAssignments` targets a resource in a **different resource group** than the system topic, deployment fails with `ResourceNotFound`.

The generated inner role-assignment deployment (`*-EventGrid-SysTopic-ExtRoleAssign-*` → `*-ResourceRoleAssignment`) runs in the **system topic's** resource group and does not derive/set the target resource group from the supplied `resourceId`. ARM then resolves the extension-scope resource in the wrong RG.

### Repro

```bicep
// deployed into RG "rg-topic"; destination SA lives in "rg-dest"
module systemTopic 'br/public:avm/res/event-grid/system-topic:0.6.5' = {
name: 'st'
params: {
name: 'st-demo'
source: ''
topicType: 'Microsoft.Storage.StorageAccounts'
managedIdentities: { systemAssigned: true }
externalResourceRoleAssignments: [
{
resourceId: '/subscriptions/<sub>/resourceGroups/rg-dest/providers/Microsoft.Storage/storageAccounts/'
roleDefinitionId: 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a' // Storage Queue Data Message Sender
roleName: 'Storage Queue Data Message Sender'
}
]
}
}
```</sub>

### Observed (deployment operation on inner `*-ResourceRoleAssignment`)

```
code: ResourceNotFound
target: .../resourceGroups/rg-dest/providers/Microsoft.Storage/storageAccounts//providers/Microsoft.Authorization/roleAssignments/
message: "The Resource 'Microsoft.Storage/storageAccounts/' under resource group 'rg-topic' was not found."
```

The role-assignment **id** correctly points at `rg-dest`, but ARM looks for the destination under `rg-topic` (the deployment's RG).

Note: `az deployment group validate` **and** `what-if` both report success — neither catches the cross-RG write rejection; it only surfaces at actual deploy.

### Expected

`externalResourceRoleAssignments` should support destinations in any RG/subscription by deriving `resourceGroup`/`subscriptionId` from the provided `resourceId` and setting them on the nested role-assignment deployment (as `avm/ptn/authorization/resource-role-assignment` already supports when called directly with an explicit `scope`).

### Workaround

Call `avm/ptn/authorization/resource-role-assignment` as a separate module with explicit `scope: resourceGroup()`, and set `externalResourceRoleAssignments: []`.

### (Optional) Correlation Id

69c25a0c-f98a-440a-b638-21d88c9df767