Add Azure Data Link Layer assurance and MACsec checks - #247

Summary

Adds Azure public-cloud Data Link Layer assurance with complete LLC and MAC coverage plus customer-actionable ExpressRoute Direct MACsec checks.

What changed

• Generalized the assurance catalog validation foundation introduced by Add Azure Physical Layer Assurance API #240.
• Added a validated catalog covering 19 Layer 2 domains, both IEEE 802 sublayers, responsibility boundaries, applicability decisions, evidence, and limitations.
• Added authenticated GET /api/assurance/data-link-layer reporting with separate catalog coverage and evidence freshness.
• Added AZ-DL-001 for enabled ExpressRoute Direct links without MACsec.
• Added AZ-DL-002 for ExpressRoute Direct ports of 40 Gbps or greater using a non-XPN cipher.
• Added a dedicated AZ-DL namespace and Data Link category so the controls cannot be confused with OSI Layer 3 rules.
• Added safe remediation playbooks, all four framework mappings, documentation, and offline regression tests.
• Preserved not-applicable empty inventory and indeterminate API failure paths without false findings.
• Kept CAK and CKN secret values out of findings, metadata, logs, and API responses.
• Made no frontend changes and did not score provider-owned controls.

Verification

• Backend suite: 528 passed, 2 skipped.
• Ruff check and format pass.
• Bandit reports no medium or high issues.
• DCO verification passes for both commits.
• Playbook shell syntax passes.
• Frontend lint, accessibility, internationalization, and build pass.
• Website tests pass.

Type of change

• New scan rule
• Remediation playbook
• API endpoint
• Documentation
• Compliance mapping

Testing

• Tested against a real Azure free trial subscription
• Returns correct JSON output
• Local CI-equivalent checks pass
• No hardcoded credentials or secrets

Checklist

• Every commit includes a DCO Signed-off-by trailer
• Code follows the rule template in CONTRIBUTING.md
• Matching CLI playbooks are included
• All four compliance framework mappings are updated
• No real Azure credentials are committed
• Branch name follows the project convention

Closes #241