Unable to run deployment script attached to storage account with AllowSharedKeyAccess false

**Bicep version**

0.28.1

**Describe the bug**

Recent security initiatives at my company are forbidding the use of storage account keys in favor of MSI. However, when I try to use MSI to authenticate my deployment script to my storage account and I create the storage account with allowSharedKeyAccess set to false, it just spins there for a while (about 10-15 minutes) before failing.

**To Reproduce**
Steps to reproduce the behavior:

1. Put the bicep below into a file named scripttest.bicep
2. Log into your Azure Subscription on the Az CLI.
3. Create the resource group

```bash
$ az group create --name rg_scripttest --location westus
```

4. Deploy the bicep file

```bash
$ az deployment group create --resource-group rg_scripttest --template-file ./scripttest.bicep --parameters prefix=test1
```

**Expected**: The deployment succeeds.
**Actual**: The deployment spins for a while before failing

```bicep
@maxLength(10) // Required maximum length, because the storage account has a maximum of 26 characters
param prefix string
param location string = resourceGroup().location
param userAssignedIdentityName string = '${prefix}Identity'
param storageAccountName string = '${prefix}stg${uniqueString(resourceGroup().id)}'
param vnetName string = '${prefix}Vnet'
param subnetName string = '${prefix}Subnet'
param utcValue string = utcNow()

resource vnet 'Microsoft.Network/virtualNetworks@2023-05-01' = {
name: vnetName
location: location
properties: {
addressSpace: {
addressPrefixes: [
'10.0.0.0/16'
]
}
enableDdosProtection: false
subnets: [
{
name: subnetName
properties: {
addressPrefix: '10.0.0.0/24'
serviceEndpoints: [
{
service: 'Microsoft.Storage'
}
]
delegations: [
{
name: 'Microsoft.ContainerInstance.containerGroups'
properties: {
serviceName: 'Microsoft.ContainerInstance/containerGroups'
}
}
]
}
}
]
}
}

resource subnet 'Microsoft.Network/virtualNetworks/subnets@2023-05-01' existing = {
parent: vnet
name: subnetName
}

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
name: storageAccountName
location: location
sku: {
name: 'Standard_LRS'
}
kind: 'StorageV2'
properties: {
allowBlobPublicAccess: false
minimumTlsVersion: 'TLS1_2'
allowSharedKeyAccess: false
networkAcls: {
bypass: 'AzureServices'
virtualNetworkRules: [
{
id: subnet.id
action: 'Allow'
state: 'Succeeded'
}
]
defaultAction: 'Deny'
}
}
}

resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
name: userAssignedIdentityName
location: location
}

resource storageFileDataPrivilegedContributor 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
name: '69566ab7-960f-475b-8e7c-b3118f30c6bd' // Storage File Data Privileged Contributor
scope: tenant()
}

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
scope: storageAccount

name: guid(storageFileDataPrivilegedContributor.id, userAssignedIdentity.id, storageAccount.id)
properties: {
principalId: userAssignedIdentity.properties.principalId
roleDefinitionId: storageFileDataPrivilegedContributor.id
principalType: 'ServicePrincipal'
}
}

resource dsTest 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
name: '${prefix}DS'
location: location
identity: {
type: 'userAssigned'
userAssignedIdentities: {
'${userAssignedIdentity.id}': {}
}
}
kind: 'AzureCLI'
properties: {
forceUpdateTag: utcValue
azCliVersion: '2.59.0'
storageAccountSettings: {
storageAccountName: storageAccountName
storageAccountKey: null
}
containerSettings: {
subnetIds: [
{
id: subnet.id
}
]
}
scriptContent: 'echo "Hello world!"'
retentionInterval: 'P1D'
cleanupPreference: 'OnExpiration'
}
dependsOn: [
roleAssignment, storageAccount
]
}
```

**Additional context**

The container instance is created, but it just sits in the 'Waiting' state.

Start with the scripttest.bicep example and reproduce it with the provided az group create and az deployment group create commands. Inspect the Microsoft.Resources/deploymentScripts resource, its storageAccountSettings, identity, roleAssignment, and subnet configuration, then verify that the deployment completes instead of leaving the container instance in Waiting and eventually failing.

Written by the indexing model from the issue text.