fedora-intune: install the Defender managed config when Defender starts

The managed config shipped in /etc never reached updated devices:
mdatp-firstboot creates /etc/opt/microsoft/mdatp on the device, so ostree's
/etc merge treats that directory as local and doesn't add new image files
under it. VM 123 had the file in /usr/etc but not in /etc, and Defender
kept its defaults.

Ship it in /usr/share/mdatp-managed/ and install it into
/etc/opt/microsoft/mdatp/managed/ from an ExecStartPre in mdatp.service.
This also applies changes from newer images and undoes local edits.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/files/mdatp-managed-config.conf

@@ -0,0 +1,7 @@
+# Install the image's enforced Defender settings each time Defender starts.
+# The image can't ship them in /etc directly: mdatp-firstboot creates
+# /etc/opt/microsoft/mdatp on the device, so on updates that directory counts
+# as local and ostree's /etc merge never adds new files under it. Copying on
+# every start also picks up changes from newer images and undoes local edits.
+[Service]
+ExecStartPre=+/usr/bin/install -D -Z -m 0644 /usr/share/mdatp-managed/mdatp_managed.json /etc/opt/microsoft/mdatp/managed/mdatp_managed.json