feat: add rule AZ-KV-006 - Key Vault using legacy access policies instead of RBAC

[dipeshrayg]

What does this PR do?

Adds scan rule AZ-KV-006, which flags Azure Key Vaults still authorizing access through legacy vault access policies instead of Azure RBAC.

Type of change

• New scan rule
• Remediation playbook
• Compliance mapping

Rule details

• Rule ID: AZ-KV-006
• Severity: MEDIUM
• Category: Key Vault
• Frameworks mapped: CIS (see note below) / NIST / ISO 27001 / SOC 2

Testing

• Tested against a real Azure free trial subscription — not done; I don't currently have one provisioned. Happy to do this before merge if required.
• Returns correct JSON output — verified via tests/test_rules_keyvault.py (compliant, non-compliant, and missing-property cases, mocked AzureClient), 18/18 passing locally
• All seven CI checks pass — unverified locally (this sandbox is missing several project dependencies, e.g. the azure SDK packages, unrelated to this change), but tests/test_cis_benchmark_mapping.py (duplicate-control-id and rule/mapping-agreement checks) passes for this rule specifically
• No hardcoded credentials or secrets

Related issue

Closes #234

Note on the CIS mapping

The official CIS Azure Foundations Benchmark control for "Enable Role Based Access Control for Azure Key Vault" is 8.6. In this repo, 8.6 is already assigned to AZ-KV-004 (purge protection) — an unrelated check, and looks like a pre-existing mapping error. I didn't want to unilaterally reassign another rule's control ID in this PR, so AZ-KV-006 is mapped to TBD-KV-006 for now, following the same TBD-* placeholder convention already used elsewhere in cis_azure_benchmark.json (e.g. TBD-IDN-010). Flagged in issue #234 for a maintainer decision.

Checklist

• Every commit includes a DCO Signed-off-by trailer (git commit -s)
• My code follows the rule template in CONTRIBUTING.md
• I added or updated the matching CLI playbook
• I added or updated all four compliance framework mappings
• I have not committed any real Azure credentials
• My branch name follows the convention: feat/description

[TFT444]

@dipeshrayg Thanks for working on AZ-KV-006. The rule and test coverage look good, but the PR is not ready to merge yet:

• The PR targets main instead of dev. This has pulled 100 historical commits and 74 unrelated files into the PR.
• GitHub currently reports merge conflicts. Please retarget the PR to dev and resolve them.
• In the playbook, use ${1:-} and ${2:-} so missing arguments show the usage message instead of failing because of set -u.
• Display the RBAC migration warning before changing the vault. Existing role assignments must be prepared first to prevent loss of access.
• Please confirm the TBD-KV-006 CIS mapping with a maintainer.
• Semgrep passed, but the complete CI suite has not run. Please ensure all required checks pass after fixing the branch.

Once these points are addressed, we can review it again.

[Vishnu2707]

we don't check authorization model anywhere else in the KV rules. Code and tests look good to me, good job @dipeshrayg . Only thing pending on our end is sorting out the CIS 8.6 collision with AZ-KV-004, we'll get that resolved and update the mapping. Approving this for now.

@TFT444 - can u have a look at the collision.