Simplify applications' permissionScopes (OAuth2 scopes) and appRoles updates via Bicep

Is your feature request related to a problem? Please describe.
Updating the permissionScopes or appRoles collections is extremely cumbersome on an application registration. We've seen multiple issues filed for this. While it does conform to desired state configuration, it's unintuitive that to remove a permission scope or app role record from the collection it cannot simply be removed from the Bicep file declaration and deployed. Instead it's a 2-step process where:

1. the existing collection must be updated to mark any records (that need to be deleted) as disabled ("isEnabled": false), and the template deployed
2. one deployed, the collection can be updated to remove the disabled records, and the template deployed

This 2-step process is particularly cumbersome for any pipeline automations.

Describe the solution you'd like
Investigate whether the Graph Bicep extension layer can hide this complexity by offering a more straightforward desired state configuration solution. This solution would allow the template author to simply update the permissionScopes and appRoles collections removing any records that the author no longer needs.

Additional context
It's possible that this safeguard was originally introduced in the REST layer to prevent accidental deletion of records in these collections, for customers who might have expected these collections to have "append semantics". This doesn't seem as desirable in the Bicep layer.