Tier 3 Creates the Resource Group in the wrong subscription

[LManning-Dev]

Description

When a Tier 3 is deployed, it gets created in the -currently logged into- subscription. It is missing the scope

Steps to Reproduce

Log into any Subscription other than the Tier 3 subscription in the same tenant.
Deploy Tier 3 and specify a workloadSubscriptionId parameter

Expected behavior

Resource Group should be created in the Tier 3 Subscription

Actual behavior

Resource Group is created in the currently logged into tenant

Screenshots

Additional context

The Resource Group Module on line 120 should have a scope to the tier3 (workload) subscription
Some other scopes need to be tweaked

module resourceGroup '../../modules/resource-group.bicep' = {
name: workloadResourceGroupName
scope: subscription(workloadSubscriptionId)
params: {
name: workloadResourceGroupName
location: location
tags: calculatedTags
}
}

module spokeNetwork '../../core/spoke-network.bicep' = {
name: 'spokeNetwork'
scope: az.resourceGroup(workloadSubscriptionId, resourceGroup.name)

module workloadVirtualNetworkPeerings '../../core/spoke-network-peering.bicep' = {
name: take('${workloadName}-to-hub-vnet-peering', 64)
scope: subscription(workloadSubscriptionId)