Add Azure Data Link Layer assurance and MACsec checks

[ritiksah141]

Summary

Adds Azure public-cloud Data Link Layer assurance with complete LLC and MAC coverage plus customer-actionable ExpressRoute Direct MACsec checks.

What changed

• Generalized the assurance catalog validation foundation introduced by Add Azure Physical Layer Assurance API #240.
• Added a validated catalog covering 19 Layer 2 domains, both IEEE 802 sublayers, responsibility boundaries, applicability decisions, evidence, and limitations.
• Added authenticated GET /api/assurance/data-link-layer reporting with separate catalog coverage and evidence freshness.
• Added AZ-DL-001 for enabled ExpressRoute Direct links without MACsec.
• Added AZ-DL-002 for ExpressRoute Direct ports of 40 Gbps or greater using a non-XPN cipher.
• Added a dedicated AZ-DL namespace and Data Link category so the controls cannot be confused with OSI Layer 3 rules.
• Added safe remediation playbooks, all four framework mappings, documentation, and offline regression tests.
• Preserved not-applicable empty inventory and indeterminate API failure paths without false findings.
• Kept CAK and CKN secret values out of findings, metadata, logs, and API responses.
• Made no frontend changes and did not score provider-owned controls.

Verification

• Backend suite: 528 passed, 2 skipped.
• Ruff check and format pass.
• Bandit reports no medium or high issues.
• DCO verification passes for both commits.
• Playbook shell syntax passes.
• Frontend lint, accessibility, internationalization, and build pass.
• Website tests pass.

Type of change

• New scan rule
• Remediation playbook
• API endpoint
• Documentation
• Compliance mapping

Testing

• Tested against a real Azure free trial subscription
• Returns correct JSON output
• Local CI-equivalent checks pass
• No hardcoded credentials or secrets

Checklist

• Every commit includes a DCO Signed-off-by trailer
• Code follows the rule template in CONTRIBUTING.md
• Matching CLI playbooks are included
• All four compliance framework mappings are updated
• No real Azure credentials are committed
• Branch name follows the project convention

Closes #241

[TFT444]

Hey @ritiksah141 , the PR looks good overall, but it needs a few fixes before merging. Please change macsec_config to the real Azure SDK field mac_sec_config, add a test using the correct SDK object structure, use each ExpressRoute link’s unique ID in findings, and keep API failures clearly indeterminate instead of treating them like empty inventory.

[ritiksah141]

@TFT444, the PR Implemented the requested changes in 311f02f:

• Replaced macsec_config with the Azure SDK field mac_sec_config.
• Added regression coverage using real ExpressRoutePort, ExpressRouteLink, and ExpressRouteLinkMacSecConfig models.
• Changed finding identity to each ExpressRoute child link ID, with a link-specific resource name.
• Split empty inventory from API failure handling. Empty inventory is NOT_APPLICABLE; API failure is INDETERMINATE, logs an explicit warning, and creates no finding.
• Added assertions covering both applicability states and secret non-disclosure.

Local verification: 529 passed, 2 skipped; Ruff, format, and Bandit pass.

[TFT444]

all the fixes are done from my side.