Azure dns_azure not working when service principal sp permissions are scoped to a /TXT/_acme-challenge.subdomain

The [updated wiki instructions](https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Azure-DNS) when assigning a scope to the service principal (sp) and limiting the scope to: `dnszones/example.com/TXT/_acme-challenge.subdomain` do not work for me (as opposed to the much more permissive, create-any-record scope of `dnszones/example.com`).

Created my scope:

```
az ad sp create-for-rbac --name "AcmeDnsValidator" --role "DNS Zone Contributor" --scopes \
/subscriptions/12345678-9abc-def0-1234-567890abcdef/resourceGroups/exampledns_rg/providers/Microsoft.Network/dnszones/example.com/TXT/_acme-challenge.subdomain
```

Validated my permissions and scope by logging in as the new sp and create the `_acme-challenge.subdomain` TXT record successfully:

```
az logout
az login --service-principal -u [appId] -p [password] --tenant [tenant]
az network dns record-set txt add-record -g exampledns_rg -z example.com -n "_acme-challenge.subdomain" -v "testvalue"
```

Returns success:

```
{
"TTL": 3600,
"TXTRecords": [
{
"value": [
"testvalue"
]
}
],
"etag": "[redacted]",
"fqdn": "_acme-challenge.subdomain.example.com.",
"id": "/subscriptions/12345678-9abc-def0-1234-567890abcdef/resourceGroups/exampledns_rg/providers/Microsoft.Network/dnszones/example.com/TXT/_acme-challenge.subdomain",
"name": "_acme-challenge.subdomain",
"provisioningState": "Succeeded",
"resourceGroup": "exampledns_rg",
"targetResource": {},
"trafficManagementProfile": {},
"type": "Microsoft.Network/dnszones/TXT"
}
```

Further validation that I can read the record, not just create it:

```
az network dns record-set txt show -g exampledns_rg -z example.com -n "_acme-challenge.subdomain"
```

Returns the same as above:

```
{
"TTL": 3600,
"TXTRecords": [
{
"value": [
"testvalue"
]
}
],
"etag": "[redacted]",
"fqdn": "_acme-challenge.subdomain.example.com.",
"id": "/subscriptions/12345678-9abc-def0-1234-567890abcdef/resourceGroups/exampledns_rg/providers/Microsoft.Network/dnszones/example.com/TXT/_acme-challenge.subdomain",
"name": "_acme-challenge.subdomain",
"provisioningState": "Succeeded",
"resourceGroup": "exampledns_rg",
"targetResource": {},
"trafficManagementProfile": {},
"type": "Microsoft.Network/dnszones/TXT"
}
```

However, acme.sh gives an error:

```
[Tue Jan 13 00:17:12 UTC 2026] Checking domain: _acme-challenge.subdomain.example.com
[Tue Jan 13 00:17:12 UTC 2026] Checking domain: subdomain.example.com
[Tue Jan 13 00:17:12 UTC 2026] Checking domain: example.com
[Tue Jan 13 00:17:12 UTC 2026] Checking domain: com
[Tue Jan 13 00:17:12 UTC 2026] Checking domain:
[Tue Jan 13 00:17:12 UTC 2026] Invalid domain
[Tue Jan 13 00:17:12 UTC 2026] invalid domain
[Tue Jan 13 00:17:12 UTC 2026] Error adding TXT record to domain: _acme-challenge.subdomain.example.com
[Tue Jan 13 00:17:12 UTC 2026] _on_issue_err
```

If I remove the `/TXT/_acme-challenge.subdomain` scope limit from the sp, then acme.sh is happy.

Reproduce with the provided Service Principal scope `dnszones/example.com/TXT/_acme-challenge.subdomain` and domain `_acme-challenge.subdomain.example.com`, confirming the same `Invalid domain` sequence. Compare this with the permissive `dnszones/example.com` scope to validate the difference in behavior. Inspect the dns_azure code path and domain validation flow in the repository, and run the failing issuance flow with DNS debug logs enabled. Done means a scoped SP can add/validate TXT records successfully without the invalid-domain error.

Scritto dal modello di indicizzazione a partire dal testo della issue.