Help user figure out what BCP165 really means

I got this error message:

```
A resource's computed scope must match that of the Bicep file for it to be deployable. This resource's scope is computed from the "scope" property value assigned to ancestor resource "keyVault". You must use modules to deploy resources to a different scope.bicep(BCP165)
```

I couldn't wrap my head around it.

I had this:

```bicep
param name string = 'add'

param keyVaultName string
param keyVaultResourceGroupName string = resourceGroup().name
param permissions object = { secrets: [ 'get', 'list' ] }
param principalId string

resource keyVaultAccessPolicies 'Microsoft.KeyVault/vaults/accessPolicies@2022-07-01' = {
parent: keyVault
name: name
properties: {
accessPolicies: [ {
objectId: principalId
tenantId: subscription().tenantId
permissions: permissions
} ]
}
}

resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
name: keyVaultName
scope: resourceGroup(keyVaultResourceGroupName)
}

```

But it turns out I didn't need to pass in the RG for scope, I can just set scope of the module when it is called like this:

```bicep
module webKeyVaultAccess '../core/security/keyvault-access.bicep' = {
name: 'web-keyvault-access'
scope: resourceGroup(keyVaultResourceGroupName)
params: {
principalId: webIdentity.properties.principalId
keyVaultName: keyVault.name
}
dependsOn: [keyVault]
}
```

It would be nice if the error message was updated with a sample on how to fix it.

The issue provides a BCP165 reproducer and a module-based workaround. Start by locating the BCP165 diagnostic definition and its related tests; done means the error message includes a clear sample showing how to move deployment to a module, with the diagnostic behavior covered.

Written by the indexing model from the issue text.