Detect aad exclusions near misses

[JosephRWalter]

🗣 Description

Adds near miss exclusion detection where "near miss" scenarios are identified when missing exclusions in the configuration would allow the policy to pass.

Identified near misses are added to the HTML, JSON, and PowerShell output.

💭 Motivation and context

Closes #2326

🧪 Testing

Locally test each AAD policy with exclusions using SCuBACached. Confirm the output is correct in the HTML, JSON, and PowerShell output.

Confirm the Rego unit tests and functional tests are passing for each test tenant.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• PR targets the correct parent branch (e.g., main or release-name) for merge.
• Changes are limited to a single goal - eschew scope creep!
• Changes are sized such that they do not touch excessive number of files.
• All future TODOs are captured in issues, which are referenced in code comments.
• These code changes follow the ScubaGear content style guide.
• Related issues these changes resolve are linked preferably via closing keywords.
• All relevant type-of-change labels added.
• All relevant project fields are set.
• All relevant repo and/or project documentation updated to reflect these changes.
• Unit tests added/updated to cover PowerShell and Rego changes.
• Functional tests added/updated to cover PowerShell and Rego changes.
• All automated checks (e.g., linting, static analysis, unit/smoke tests) passed.

✅ Pre-merge checklist

• PR passed smoke test check.

• PR/feature branch passes functional tests for relevant products, if applicable.

• Feature branch has been rebased against changes from parent branch, as needed.

  Use Update branch button below or use this reference to rebase from the command line.

• Resolved all merge conflicts on branch.

• Squash all commits into one PR level commit using the Squash and merge button.

✅ Post-merge checklist

• Feature branch deleted after merge to clean up repository.
• Close issues resolved by this PR if the closing keywords did not activate.
• Verified that all checks pass on parent branch (e.g., main or release-name) after merge.

[sylvesterkaczmarek]

Rechecked current head c2200a9. The structured-output gap I raised is still present in CreateReport.psm1: the omitted and incorrect-result fragment objects include NearMisses, but the normal result object at the typical branch still omits the field.

So an ordinary failed AAD control can still show the near miss in human-readable details while losing the structured NearMisses data in the consolidated JSON. Please add NearMisses to the normal fragment and cover a normal Fail case in the JSON/output regression.