Cannot reference existing Microsoft.Network/natGateways instance

**Bicep version**
Bicep CLI version 0.26.54 (5e20b29b58)

**Describe the bug**
I am attempting to create a public IP and associate it with an existing NAT Gateway, but the NAT Gateway resource is never found when using `existing`.

**To Reproduce**
```bicep
param publicIPName string
param publicIPLocation string
param sku string = 'Standard'
param natGatewayName string = ''

resource natGateway 'Microsoft.Network/natGateways@2023-09-01' existing = if (natGatewayName != '') {
name: natGatewayName
}

var natGatewayProperty = natGateway != '' ? { id: natGateway.id } : { }

resource publicIP 'Microsoft.Network/publicIPAddresses@2022-11-01' = {
name: publicIPName
location: publicIPLocation
sku: {
name: sku
}
properties: {
publicIPAddressVersion: 'IPv4'
publicIPAllocationMethod: 'Static'
natGateway: natGatewayProperty
}
}
```

The intent of this bicep is if `natGatewayName` is specified as a parameter, to get the existing NAT Gateway role and add it to the Public IP role. (If none is defined, it should be empty.)

The Public IP is created, but it does not add a NAT Gateway. `what-if` shows that it ignores the named NAT Gateway role.

Example (trimmed) `--what-if` output:

```text
Note: The result may contain false positive predictions (noise).
You can help us improve the accuracy of the result by opening an issue here: https://aka.ms/WhatIfIssues

Resource and property changes are indicated with these symbols:
- Delete
~ Modify
* Ignore
x Noeffect

The deployment will update the following scope:

Scope: /subscriptions/xxx/resourceGroups/rg

~ Microsoft.Network/publicIPAddresses/public-ip [2022-11-01]
- properties.ddosSettings:

protectionMode: "VirtualNetworkInherited"

- sku.tier: "Regional"
x properties.natGateway: "[if(not(equals(reference(resourceId('Microsoft.Network/natGateways', parameters('natGatewayName')), '2023-09-01', 'full'), '')), createObject('id', resourceId('Microsoft.Network/natGateways', parameters('natGatewayName'))), createObject())]"

* Microsoft.Network/natGateways/nat-gw

Resource changes: 1 to modify, 47 to ignore.
```

In this example, natGatewayName _does_ exist and even shows as an ignored resource.

**Additional context**
I can work around this by inverting the approach and adding the public IP to the NAT Gateway, but this is problematic because I cannot add multiple public IPs easily for different roles without doing a union of old/new parameters which is not very elegant and won't clean up old IPs. It should just work by being able to reference an existing NAT Gateway and add it to a public IP.