fedora-intune: enforce Defender protection settings

Defender's defaults left behavior monitoring off and every setting
unmanaged. Ship /etc/opt/microsoft/mdatp/managed/mdatp_managed.json:
real-time protection, behavior monitoring, PUA blocking, cloud-delivered
protection at the high block level, automatic definition updates and
sample submission, and scheduled scans (daily quick at 12:00, weekly full
on Wednesday 12:30, low priority). Users can't change managed settings.
The build fails if the file isn't valid JSON.

Network protection (Insiders channels only) and tamper protection
(audit-only preview on Linux) are left out.

The compliance script and rules now also check behavior monitoring and
cloud-delivered protection.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/intune/defender-compliance.sh

@@ -28,6 +28,8 @@ healthy=false
 licensed=false
 onboarded=false
 rtp=false
+behavior_monitoring=false
+cloud_protection=false
 definitions_ok=false
 definitions_age=-1
 version=""
@@ -40,6 +42,8 @@ if [[ -x "${MDATP}" ]]; then
     healthy="$(bool "$(field healthy)")"
     licensed="$(bool "$(field licensed)")"
     rtp="$(bool "$(field real_time_protection_enabled)")"
+    [[ "$(field behavior_monitoring)" == enabled ]] && behavior_monitoring=true
+    cloud_protection="$(bool "$(field cloud_enabled)")"
     [[ -n "$(field org_id)" ]] && onboarded=true
     [[ "$(field definitions_status)" == up_to_date ]] && definitions_ok=true
     age="$(field definitions_updated_minutes_ago)"
@@ -57,6 +61,8 @@ cat <<EOF
   "DefenderLicensed": ${licensed},
   "DefenderOnboarded": ${onboarded},
   "DefenderRealTimeProtection": ${rtp},
+  "DefenderBehaviorMonitoring": ${behavior_monitoring},
+  "DefenderCloudProtection": ${cloud_protection},
   "DefenderDefinitionsUpToDate": ${definitions_ok},
   "DefenderDefinitionsAgeDays": ${definitions_age},
   "DefenderVersion": "${version}"