feat(scanner): add AZ-XXX-000/AZ-XXX-000 Trusted Launch and Managed Identity rules

[parthrohit22]

Rule 1: VM Trusted Launch not enabled

• Rule ID: AZ-XXX-000
• Severity: MEDIUM
• Category: Compute
• Frameworks: CIS / NIST / ISO 27001

What it detects: Generation 2 VMs where Trusted Launch (Secure Boot and vTPM) is not enabled.

Detection logic: Check security_profile.security_type == "TrustedLaunch" and that both
uefi_settings.secure_boot_enabled and uefi_settings.v_tpm_enabled are true. Skip
(NOT_APPLICABLE) Generation 1 VMs, which don't support Trusted Launch.

Why it matters: Without Secure Boot and vTPM, malicious or unsigned code can run during boot and
persist beneath the OS, evading OS-level antimalware and EDR entirely.

Remediation: Portal (VM > Configuration > Security type), or
az vm update --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true
(requires a restart; only supported VM sizes/images).

Test plan (Rule 1 only)

• Tested against a real Azure free trial subscription
• Compliant case returns no findings
• Non-compliant case returns correct finding
• Gen1 VMs correctly return NOT_APPLICABLE for the Trusted Launch rule, not a false finding
• CLI playbook written and tested
• All four compliance framework JSONs updated

Coordination

The originally-scoped "VM without Managed Identity" rule (Rule 2) has been removed from this
issue to avoid overlapping the enterprise identity work. The Trusted Launch rule (Rule 1) above
is the sole remaining scope of this issue. The VM Managed Identity rule is now tracked within the
enterprise identity packs — #254 (App Identity/OAuth), #258 (Privileged Access/Identity), and the
closed #193 (Managed Identity pack) — and should be picked up as part of that pack rather than as
a standalone rule.

[parthrohit22]

Scope update — VM Managed Identity rule moved out to avoid overlap.

After cross-checking against the open enterprise-rule packs, the second rule originally in this issue ("VM without Managed Identity") was removed from this issue. It overlaps the enterprise identity scope already tracked in #254 (App Identity / OAuth), #258 (Privileged Access / Identity), and the closed #193 (Managed Identity pack).

Remaining scope of this issue: only Rule 1 — VM Trusted Launch not enabled (new rule, no existing duplicate). The Trusted Launch rule is a clean new-rule / good first issue and does not conflict with any enterprise pack.

The VM Managed Identity rule should be picked up as part of the enterprise identity pack rather than as a standalone rule. Tagging the identity work (#254, #258) so it is absorbed into the right place and no contributor double-builds it.

No new issue was created for the VM Managed Identity rule — that would itself add overlapping work; it simply moved home.

[shariqueahmad108-ship-it]

I'd like to work on this — I've opened #273 implementing Rule 1 (AZ-CMP-005, VM Trusted Launch / Secure Boot + vTPM), scoped to the Trusted Launch rule only per the Coordination note. It includes the remediation playbook, all four compliance-framework mappings, and unit tests for the compliant / non-compliant Gen2 / Gen1 NOT_APPLICABLE / unknown-generation / Confidential-VM cases. Happy to adjust anything in review.