WIP: Linux Intune policy application

[dmulder]

Fixes #60

Summary of Changes

Himmelblau now fetches and applies Linux Intune policies when they are configured in Microsoft's Intune portal. This update introduces two new policy implementations for Linux devices:

• Script Policy: Scripts from Intune are decoded, written to disk, and scheduled to run via cron.

• Linux Compliance Policy: Validates system configuration against policy settings such as allowed Linux distributions, required device encryption, and password policy minimum length (which applies to the Hello PIN length).

Important Notes:

• While Himmelblau will enforce these Intune policies on Linux devices, the compliance flag cannot yet be set in the Entra Admin portal for the device object.
• Explicit policy assignment by device is not available at this time; however, policies can be assigned by user, group, or to all devices.
• When Intune policy application is enabled, devices which fail to comply with Intune policy will be prohibited from authenticating users.

Current Limitations:

• The following compliance policies are not yet implemented. Enforcing these policies will cause authentication to fail:
  • Password policies (note that Minimum Length is implemented):
    • Minimum digits
    • Minimum Lowercase
    • Minimum Uppercase
    • Minimum Symbols
  • Custom Compliance

[dmulder]

These patches are being held until version 1.0 and will not ship in version 0.9.