Add Zabbix agent rules

[israel-villar]

Description:

• Adds a new zabbix rule group under linux_os/guide/services/zabbix/ with three rules: package_zabbix_agent_installed and service_zabbix_agent_enabled (both using existing templates), and zabbix_agent_server_configured (custom OVAL check verifying Server/ServerActive are set in zabbix_agentd.conf and not left at the packaged 127.0.0.1 default). Adds the zabbix component.

Rationale:

• Zabbix is a widely used open-source network monitoring solution; the project already carries SELinux booleans referencing it (sebool_httpd_can_connect_zabbix, sebool_zabbix_can_network) but had no rules covering the monitoring agent itself. zabbix_agent_server_configured ships without remediation since the correct monitoring server address is site-specific.

Review Hints:

• No product profile selects these rules yet; this PR only adds the rule definitions and component. Verified with a clean ./build_product --datastream-only debian13.
• Key files: linux_os/guide/services/zabbix/*/rule.yml, linux_os/guide/services/zabbix/zabbix_agent_server_configured/oval/shared.xml, components/zabbix.yml.
• Single commit, straightforward to review as a whole.

[openshift-ci]

Hi @israel-villar. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[macko1]

Hello @israel-villar, thanks for the submission.

In order to consider this for a review, and to review this properly, please provide exact official Zabbix documentation sources for the decisions you made when creating these rules.

Also please provide full documentation (comments) into the test benches you provided (expected results)

Thanks.

[macko1]

Refer to #15128 (comment) please

[israel-villar]

▎ Thanks for the review, @macko1. Here are the exact official Zabbix sources for the decisions in this PR:
▎
▎ Server / ServerActive directive names and semantics — Zabbix agent (UNIX) configuration parameter reference:
▎ https://www.zabbix.com/documentation/current/en/manual/appendix/config/zabbix_agentd
▎ This confirms Server governs passive checks (mandatory unless StartAgents=0) and ServerActive governs active checks, which is why the check requires both to be set.
▎
▎ The 127.0.0.1 "packaged default" — the official upstream Zabbix source repository ships zabbix_agentd.conf with these two directives uncommented and set to 127.0.0.1:
▎ https://github.com/zabbix/zabbix/blob/master/conf/zabbix_agentd.conf#L132-L200
▎ (see ### Option: Server and ### Option: ServerActive — the parameter reference page itself documents no default, but this reference template is the file that ships as-is in the zabbix-agent package, which is why an unmodified install ends up with both directives pointing at 127.0.0.1.)
▎
▎ Passive vs. active checks concept, explaining why both directives are relevant to a correctly-configured agent:
▎ https://www.zabbix.com/documentation/current/en/manual/concepts/agent
▎
▎ I've also pushed a commit adding expected-result comments to each test scenario per your second request (587f3a8).