Add cross-platform DuckDB and connector validation

[billmcilhargey]

Summary

Modernizes the local assessment foundation while preserving the existing PowerShell detection engine and report schema. This draft replaces committed platform-specific DuckDB binaries with a locked build-time dependency flow, adds native ARM64 support, hardens the localhost progress server, and adds Defender for Cloud connector inventory coverage.

This work supersedes closed Microsoft PR #1167, whose Linux architecture-selection work and review feedback informed the replacement design.

Changes

Cross-platform DuckDB

• Upgrade DuckDB.NET managed bindings from 1.0.1 to pinned 1.2.1 packages.
• Add a dependency project and lock file for reproducible NuGet restore and dependency hashes.
• Materialize managed assemblies, licenses, and native assets during tests and module packaging.
• Keep generated binaries out of Git instead of vendoring loose native libraries.
• Select and preload native assets using RID-aware helpers.
• Support Windows x64/ARM64, Linux x64/ARM64, and macOS x64/ARM64.
• Improve native-library diagnostics and dispose readiness connections correctly.
• Add RID mapping, package integrity, missing-asset, and database regression tests.

Defender for Cloud connector coverage

• Add Infrastructure assessment 50002 for Microsoft.Security/securityConnectors.
• Inventory multicloud, DevOps, and registry connectors exposed through Defender for Cloud.
• Validate environment type, hierarchy identifier, and configured Defender offerings.
• Distinguish absent/incomplete connectors, authorization failures, and Resource Graph errors.
• Add remediation guidance and focused Pester coverage.

Localhost security

• Restrict progress requests to loopback clients and remove wildcard CORS.
• Add CSP, content-type, referrer, and frame hardening headers.
• Add focused server security regression tests.

Developer and CI experience

• Repair VS Code tasks that referenced a missing build script and Windows PowerShell 5.1.
• Add prerequisite, Pester, and report-template tasks using PowerShell 7.
• Validate Windows, Linux, and macOS on x64 and ARM64 runners.
• Build both report templates on Ubuntu.
• Update invocation, report output, and DuckDB troubleshooting documentation.

Validation

• Full PowerShell suite on native Windows ARM64: 14,121 passed, 0 failed, 0 skipped.
• Previously failing database suite: 8/8 passed.
• DuckDB runtime/package integrity tests: 10/10 passed.
• Native smoke test selected win-arm64 and returned DuckDB v1.2.1.
• Locked dependency materialization succeeds before module import.
• Default and classic report templates build successfully.
• git diff --check passes.

Branch comparison

This PR compares dev-feat-one-click-review directly with the fork's dev branch. The fork's dev branch remains unchanged. At creation time it was nine commits behind microsoft/zerotrustassessment:dev; those upstream changes do not overlap files changed here.

Draft status

Draft pending validation from the new hosted Linux ARM64, Windows ARM64, and macOS jobs.

[billmcilhargey]

Related legacy PR review: Microsoft PR #1170 was reviewed and closed as superseded.

Its footer-version feature is already present in both current report variants, its devcontainer change became obsolete when the devcontainer was removed, and its isolated baseUrl deletion was not carried forward because alias ownership remains split between root/app TypeScript configs and Vite while current builds pass.

The review also exposed identical Linux/macOS CI fixture failures caused by reliance on $env:TEMP and Windows-only child paths. Commit d8304cbbe updates those tests to use [IO.Path]::GetTempPath(), platform-neutral paths, and forced locked dependency restoration.

[billmcilhargey]

Upstream synchronization update:

• origin/dev is now fast-forwarded to and identical with upstream/dev at 17c6ce30.
• The feature branch merged current upstream/dev without conflicts.
• Deeper review of closed Microsoft PR #1170 confirmed its TypeScript baseUrl recommendation is still valid under the current toolchain.
• Commit c79a67b0b implements the complete cleanup across root/app/Node configs and adds casing consistency checks.
• Both report templates build successfully after removing baseUrl.

The original footer and devcontainer portions of microsoft#1170 remain superseded, so that PR stays closed and links back to this draft.

[billmcilhargey]

Legacy container-support review completed: Microsoft PR #1169 was closed after security and lifecycle review.

The original 21-file approach intercepted OAuth URLs, prepended browser wrappers to PATH, attempted privileged /etc/hosts changes, duplicated HTTP server ownership, left core wiring as TODO comments, and lacked focused lifecycle/security tests. Those mechanics were not carried forward.

Commit b731eb476 adds the safe supported workflow to this draft: device-code authentication, -NoBrowser, host/authenticated report access, and certificate-based automation, with an explicit warning against URL interception and system mutation.