Caller is not allowed to change permission model on Key Vault for Access Policies to RBAC with Bicep

**Bicep version**
Bicep CLI version 0.25.53

**Describe the bug**
When having existing Key Vault with Access Configuration set to Vault access policy and then rerun Azure DevOps pipeline to redeploy with migration to 'Azure roles-base access control (recommended)' I am getting the following error:

Caller is not allowed to change permission model. For more information on how to change the permissions model follow this link: https://go.microsoft.com/fwlink/?linkid=2155160. Details: oid=GUID; action=Microsoft.Authorization/roleAssignments/write; resource=/subscriptions/GUID/resourcegroups/RESOURCEGROUP/providers/Microsoft.KeyVault/vaults/KEYVAULTRESOURCE; decision=NotAllowed; (Code: InsufficientPermissions)

**To Reproduce**
Create a Keyvault with Bicep with Access Configuration set to 'Vault access policy' and then run again but change in Bicep the Access Configuration to 'Azure roles-base access control (recommended)'

**Additional context**
The Azure DevOps service connection (Entra ID Enterprise application) has User Access Administrator role on the subscription where the keyvault is deployed.

When changing the Access Configuration to the portal to 'Azure roles-base access control (recommended)' and then run the Azure DevOps pipeline deployment again everything goes well and also the Role assignments are going good.

I am using the AVM resource module to deploy the keyvault.

Start by reproducing the migration with the Azure Verified Modules Key Vault resource: deploy with Vault access policy, then change to Azure role-based access control and rerun the Azure DevOps pipeline. Compare the deployment permissions and role-assignment behavior with the portal workflow; done means the migration and role assignments succeed without a manual portal change.

Written by the indexing model from the issue text.