feat(query): implemented query that checks if the use of user access administrator is not restricted for terraform/azure

[cx-ricardo-jesus]

Reason for Proposed Changes

• Currently, there is no query for Terraform/Azure that checks if an resource of type azurerm_role_assignement is restricting the use of User Access Administrator role through its name or id.

Proposed Changes

• The query has just one policy, that uses an helper function called get_res that check's the two possibilities of defining the User Access Administrator role, by using the field role_definition_name and defining it to User Access Administrator or its respective ID (18d7d88d-d35e-4fb5-a5c3-7773c20a72d9).
• According to the documentation, "Either role_definition_id or role_definition_name must be set." so, I did not covered the case when both are defined.
• Additionallym based on the AppSec team's feedback, the scope field should also be taken into account. Following this guidance, the query only covers the highest permission levels - the tenant root (/) and management group (/providers/Microsoft.Management/managementGroups/<mg>). According to the Microsoft RBAC scope documentation, assigning the User Access Administratir role at these level grants permissions over all resouces in the tenant.

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.13

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0