In an Azure subscription with resources distributed across different virtual networks (VNets), which subnets are eligible for the application of a specific Network Security Group (NSG)?