fedora-intune: enforce Defender protection settings

Defender's defaults left behavior monitoring off and every setting
unmanaged. Ship /etc/opt/microsoft/mdatp/managed/mdatp_managed.json:
real-time protection, behavior monitoring, PUA blocking, cloud-delivered
protection at the high block level, automatic definition updates and
sample submission, and scheduled scans (daily quick at 12:00, weekly full
on Wednesday 12:30, low priority). Users can't change managed settings.
The build fails if the file isn't valid JSON.

Network protection (Insiders channels only) and tamper protection
(audit-only preview on Linux) are left out.

The compliance script and rules now also check behavior monitoring and
cloud-delivered protection.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/intune/defender-compliance.json

@@ -84,6 +84,34 @@
         }
       ]
     },
+    {
+      "SettingName": "DefenderBehaviorMonitoring",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Behavior monitoring is off.",
+          "Description": "Microsoft Defender behavior monitoring must be enabled. Update the device to the latest image or contact IT."
+        }
+      ]
+    },
+    {
+      "SettingName": "DefenderCloudProtection",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Cloud-delivered protection is off.",
+          "Description": "Microsoft Defender cloud-delivered protection must be enabled. Update the device to the latest image or contact IT."
+        }
+      ]
+    },
     {
       "SettingName": "DefenderDefinitionsUpToDate",
       "Operator": "IsEquals",