feat(scanner): add enterprise data protection and database rules

[TFT444]

Summary

Implements issue #261 as a policy-driven Azure data-protection and database-security rule pack.

Added controls

• Storage shared-key authorization and minimum TLS enforcement.
• Opt-in customer-managed-key and blob immutability checks.
• SQL Microsoft Entra-only authentication.
• SQL vulnerability-assessment configuration.
• SQL audit-retention minimum (90 days).
• Opt-in Cosmos DB local-authentication and public-network checks.
• Opt-in managed-cache public-access/TLS checks.

Implementation

• Added Azure client accessors for SQL vulnerability assessment, Cosmos DB accounts, and managed caches.
• Added conservative opt-in policy tags and explicit exception handling.
• Added rule documentation, framework mappings, rule-reference updates, and CLI playbooks.
• Added azure-mgmt-cosmosdb==10.0.0 and azure-mgmt-redis==14.5.0.

Validation

• Focused Implement enterprise data protection and database security rules #261/storage tests: 32 passed.
• Ruff: passed.
• Python compilation: passed.
• Framework JSON validation: passed.
• git diff --check: passed.
• Full local suite: 585 passed, 2 skipped; 4 unrelated failures remain:
  • 2 pre-existing Chroma dependency/environment failures.
  • 2 unrelated untracked az_cmp/az_net tests.

The playbooks are review-safe guidance commands; they do not apply irreversible Azure changes automatically.

Closes #261

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/azure-mgmt-cosmosdb	10.0.0	Unknown	Unknown
pip/azure-mgmt-redis	14.5.0	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices 🟢 5 badge detected: Passing Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Binary-Artifacts 🟢 8 binaries present in source code SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 Fuzzing 🟢 10 project is fuzzed

Scanned Files

• requirements.txt

[Vishnu2707]

@ritiksah141 @parthrohit22 - an initial review would be appreciated.

[m-khan-97]

Thanks for putting this rule pack together. I went through the implementation and tests carefully. The direction is useful, but I found three things we need to fix before merging:

1. AZ-STOR-009 cannot currently be enabled for a real blob container. The shared policy helper reads resource.tags, while Azure BlobContainer objects expose metadata rather than ARM tags. That means the documented oshield:immutability-required marker will never be seen and the rule will silently skip every real container. Please use a supported source of applicability, such as container metadata or an account-level policy, and add a regression test with an SDK-shaped BlobContainer object.

2. The NIST mapping for AZ-DB-007 is incorrect. A.12.4.1 is an ISO 27001 control, not a NIST CSF identifier. Please correct it consistently in the rule, nist_csf.json, and the rules reference. If there is no verified direct mapping, use an explicit N/A value.

3. Several files presented as remediation playbooks only print guidance. This affects the cache, Cosmos, and SQL rules in this PR. Since the API exposes these files as CLI remediation, either implement safe, validated commands with proper argument handling or classify them clearly as manual guidance instead of executable remediation.

I ran the focused rule tests locally and all 24 passed. The Azure client test module could not collect because this checkout is missing azure.mgmt.authorization, so I did not treat that environment issue as a PR failure. The points above are production contract gaps that the current mocked tests do not cover.

Once these are addressed, I will be happy to take another look.

[TFT444]

All three blockers addressed in the latest commit:

1. AZ-STOR-009 opt-in check moved from the BlobContainer to the parent storage account, which exposes ARM tags via the SDK. All containers under a tagged account are now evaluated.
2. AZ-DB-007 NIST mapping corrected from A.12.4.1 (ISO 27001) to PR.PT-1 across the rule, nist_csf.json, and rules-reference.
3. All six echo-only playbooks now contain validated az CLI commands behind an APPLY confirmation gate.

Ready for re-review.