[AVM Module Issue]: TDE dependency issue with key vault in CMK scenario

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Issue Type?

Bug

### (Optional) Module Version

v0.3.1

### (Optional) Correlation Id

_No response_

### Description

This bug report extends the issue #101

When the revised order is implemented another dependency issue will occur. The racing condition are as follows:
To enable customer-managed key for TDE (transparent data encryption) the module expects the key id of the encryption key. Therefore the key vault, the encryption key and the access policy/RBAC role assignment for the managed instance have to be created BEFORE TDE is enabled with customer-managed keys.

Scenario 1: Key vault created before managed instance
-> Create Azure key vault -> OK
-> Create encryption key -> OK
-> Create IAM role assignment or access policy for managed instance -> FAIL (no managed instance created yet, so no identity available from module output)

Scenario 2: Managed instance created before key vault
- > Create managed instance via module -> OK
-> Configure TDE in module -> FAIL (There is no key vault and thus key vault key id yet)

**My recommendation would be to create:**
- the access policy with
```
key_permissions = [
"Get", "WrapKey", "UnwrapKey"
]
```
or
- an IAM role assignment with
`role_definition_name = "Key Vault Crypto Service Encryption User"`
within the module similar to the one required for vulnerability assessments to function stating at line 145 in main.tf where we provide
```
scope = var.storage_account_resource_id
role_definition_name = "Storage Blob Data Contributor"
```
to avoid an "hen and the egg" situation with the storage account permissions for the managed instance.

The "key_vault_key_id" for `var.transparent_data_encryption` can be provided by the AVM key vault module as an [output](https://github.com/Azure/terraform-azurerm-avm-res-keyvault-vault/blob/main/outputs.tf) either as "id" or "versionless_id". The module would only need another variable like `var.key_vault_resource_id` or something similar.

Start by reading the module's transparent_data_encryption handling and main.tf around line 145, then compare the dependency ordering in issue #101. Review the Azure Key Vault module outputs for id and versionless_id and the existing storage-account role assignment pattern. Done means the managed instance, key vault key, and required access policy or RBAC assignment can be composed without the circular dependency described in both scenarios.

Written by the indexing model from the issue text.