fedora-intune: enforce Defender protection settings

Defender's defaults left behavior monitoring off and every setting
unmanaged. Ship /etc/opt/microsoft/mdatp/managed/mdatp_managed.json:
real-time protection, behavior monitoring, PUA blocking, cloud-delivered
protection at the high block level, automatic definition updates and
sample submission, and scheduled scans (daily quick at 12:00, weekly full
on Wednesday 12:30, low priority). Users can't change managed settings.
The build fails if the file isn't valid JSON.

Network protection (Insiders channels only) and tamper protection
(audit-only preview on Linux) are left out.

The compliance script and rules now also check behavior monitoring and
cloud-delivered protection.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/files/mdatp_managed.json

@@ -0,0 +1,29 @@
+{
+  "antivirusEngine": {
+    "enforcementLevel": "real_time",
+    "behaviorMonitoring": "enabled",
+    "scanAfterDefinitionUpdate": true,
+    "scanArchives": true,
+    "disallowedThreatActions": ["allow", "restore"],
+    "threatTypeSettingsMergePolicy": "admin_only",
+    "threatTypeSettings": [
+      { "key": "potentially_unwanted_application", "value": "block" },
+      { "key": "archive_bomb", "value": "audit" }
+    ],
+    "scheduledScan": "enabled"
+  },
+  "scheduledScan": {
+    "dailyConfiguration": { "timeOfDay": 720 },
+    "weeklyConfiguration": { "dayOfWeek": 4, "scanType": "full", "timeOfDay": 750 },
+    "lowPriorityScheduledScan": true,
+    "checkForDefinitionsUpdate": true,
+    "randomizeScanStartTime": 2
+  },
+  "cloudService": {
+    "enabled": true,
+    "diagnosticLevel": "required",
+    "automaticSampleSubmissionConsent": "safe",
+    "automaticDefinitionUpdateEnabled": true,
+    "cloudBlockLevel": "high"
+  }
+}