feat: AZ-NET-013 Azure Firewall not enabled on Virtual Network

[aav-wh]

Summary

Adds a new HIGH severity scanner rule to detect Virtual Networks that do not have an Azure Firewall deployed.

Changes

• scanner/rules/az_net_013.py — scan rule detecting VNets without Azure Firewall
• playbooks/cli/fix_az_net_013.sh — remediation playbook to deploy Azure Firewall
• scanner/azure_client.py — added get_azure_firewalls() method
• Updated CIS, NIST CSF, ISO 27001, SOC 2 compliance JSON files

Why

A VNet without Azure Firewall relies solely on NSGs for perimeter defence. NSGs provide no deep packet inspection, threat intelligence filtering, or centralised traffic logging, leaving the network vulnerable to lateral movement and data exfiltration.

Compliance

• CIS: 6.4
• NIST CSF: PR.AC-5
• ISO 27001: A.13.1.1
• SOC 2: CC6.6

Closes #91

[Vishnu2707]

Approved. get_azure_firewalls() scoped to resource group and follows the client pattern. One logical gap worth a follow-up issue: the scan flags a VNet if its own resource group has no firewall, but a hub-spoke setup could have the firewall in a separate resource group, this will produce false positives. Not blocking for now but worth tracking @aav-wh

[Vishnu2707]

Resolved the conflicts!

[Vishnu2707]

CI is failing, all 4 compliance JSONs have invalid JSON at the merge conflict resolution. Looks like the conflict markers weren't cleaned up properly, missing a comma delimiter around line 170 in cis, nist, iso27001 and line 165 in soc2. Fix the JSON syntax in those files and push again @aav-wh

[Vishnu2707]

CI is failing all 4 compliance JSONs have invalid JSON at the merge conflict resolution. Looks like the conflict markers weren't cleaned up properly, missing a comma delimiter around line 170 in cis, nist, iso27001 and line 165 in soc2. Fix the JSON syntax in those files and push again.