[RULE] AZ-SC: Pipeline service connection scoped to subscription and shared across pipelines #216

Summary

Part of the A03 Software Supply Chain Failures gap tracked in #213. Depends on the Azure DevOps auth integration (#215) landing first.

New rule: AZ-SC Pipeline service connection scoped to subscription and shared across all pipelines.

The risk

Microsoft's own guidance recommends scoping a service connection to the minimum resource it needs a service principal deploying a single App Service does not need Contributor on the entire subscription. A service connection that is both (a) scoped to the whole subscription and (b) shared across every pipeline in the project means any pipeline, including ones with lower review standards, inherits subscription-wide access. This is the DevOps-specific version of the "over-privileged identity" pattern already checked for Azure RBAC via AZ-IDN-001 (Owner role at subscription scope).

Detection

Via serviceendpoint/endpoints: flag an endpoint where type == "AzureRM", its data/scope indicates subscription-level (not resource-group-scoped), and isShared == true.

Acceptance criteria

• scanner/rules/az_sc_*.py following the standard rule template (RULE_ID, SEVERITY, CATEGORY = "Supply Chain", FRAMEWORKS, DESCRIPTION, REMEDIATION, PLAYBOOK)
• Compliant / non-compliant / indeterminate (API failure → skip, no false positive) test cases
• Playbook under playbooks/cli/
• Added to docs/rules-reference.md and the compliance framework JSONs

Parent issue: #213
Depends on: #215