fedora-intune: report full image version to Intune, Defender compliance script

Himmelblau reports VERSION_ID from /etc/os-release as the device OS version,
so Intune showed "44". Give himmelblaud and himmelblaud-tasks their own
os-release (bind-mounted in their mount namespace only) with VERSION_ID set to
OSTREE_VERSION, e.g. 44.20261019.0. The rest of the system keeps the stock
VERSION_ID that toolbox, flatpak and dnf expect.

Add an Intune custom compliance discovery script and rules for Microsoft
Defender for Endpoint (installed, running, onboarded, licensed, healthy,
real-time protection, definitions up to date). These are uploaded to Intune,
not shipped in the image.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/files/10-himmelblau-os-release.conf

@@ -0,0 +1,9 @@
+# Report the full image version (VERSION_ID=44.20261019.0) to Entra ID and
+# Intune instead of "44"; see /usr/libexec/himmelblau-os-release. Only this
+# service's mount namespace sees the replacement os-release.
+[Unit]
+Requires=himmelblau-os-release.service
+After=himmelblau-os-release.service
+
+[Service]
+BindReadOnlyPaths=/run/himmelblau-os-release:/etc/os-release