[Issue] Changing SRE Agent Resource Group Scope in Portal UI requires Built-in Owner or User Access Admin permissions

Nobody has claimed this yet.

## Issue Description
The SRE Agent is deployed using the Bicep template provided in the Microsoft GitHub repository. As part of our organization's least-privilege security model, custom RBAC roles are used to deploy and manage the SRE Agent rather than broad built-in roles such as Owner.

The SRE Agent deploys successfully using these custom roles. However, after deployment, when a user attempts to modify the SRE Agent scope by adding additional resource groups through the Azure portal, the list of available resource groups is empty.

### The portal displays the following message:
_"Only resources where you have the Owner or User Access Administrator role are listed. These roles are required to grant access."_

As a result, the user cannot select additional resource groups, save the changes, or update the SRE Agent scope, even though the user has custom RBAC permissions intended to provide the required resource and role-assignment capabilities. Current workaround is to use bicep template to make the changes.

## Thread ID
Not Available

## Steps to Reproduce

1. Deploy Azure SRE Agent using the Bicep template from the Microsoft GitHub repository.
2. Use custom Azure RBAC roles for the deployment instead of assigning the user the built-in Owner or User Access Administrator role.
3. Confirm that the SRE Agent deployment completes successfully.
4. In the Azure portal, open the deployed SRE Agent.
5. Navigate to the area used to manage the SRE Agent resource scope.
6. Attempt to add an additional resource group to the SRE Agent scope.
7. Observe that the list of available resource groups is empty.
8. Observe the following message:
"Only resources where you have the Owner or User Access Administrator role are listed. These roles are required to grant access."

Because no resource groups are available for selection, the user is unable to add the resource group or save the scope change.

## Expected Behavior

If a user has a custom RBAC role that provides the effective permissions required to manage the SRE Agent scope and grant the necessary access to the target resources, the Azure portal should allow the user to:

- View eligible resource groups.
- Add or remove resource groups from the SRE Agent scope.
- Save changes to the managed resource scope.

Ideally, authorization should be based on the effective RBAC permissions required to perform the operation rather than requiring assignment of the specific built-in Owner or User Access Administrator roles.
If Owner or User Access Administrator is an explicit product requirement for this operation, this requirement should be clearly documented, including whether equivalent custom RBAC roles are supported.

## Actual Behavior

After deployment, when a user attempts to modify the SRE Agent scope by adding additional resource groups through the Azure portal:

- The list of available resource groups is empty.
- The user is unable to select additional resource groups.
- The user is unable to save any scope changes.
- The portal displays the following message:

_"Only resources where you have the Owner or User Access Administrator role are listed. These roles are required to grant access."_
This occurs even when the user has been assigned a custom RBAC role intended to provide the permissions necessary to manage the SRE Agent and associated resource access.

Start by reviewing the Azure portal SRE Agent scope-management flow and the referenced Bicep deployment template, then compare the custom RBAC permissions with the roles required by the portal. Confirm whether equivalent custom roles are supported and make the scope update usable or document the explicit role requirement, with resource groups listed and scope changes saved successfully.

Written by the indexing model from the issue text.