Seed security knowledge corpus (16 articles + 30 AL samples)

Converts Jesper's existing AL security-review prompt into BCQuality seed
knowledge articles so the al-security-review leaf has a real corpus to
match against. Mirrors the performance seed phase.

Articles under microsoft/knowledge/security/ (16):
- Permission model: follow-least-privilege-in-permission-sets,
  use-indirect-permissions-for-elevated-access,
  use-inherent-permissions-to-grant-minimal-access
- Secrets: never-hardcode-secrets-in-al,
  use-isolated-storage-for-module-and-company-secrets,
  prefer-azure-key-vault-for-production-secrets,
  use-secrettext-for-credentials, use-secrettext-with-httpclient,
  compose-secrets-with-secretstrsubstno,
  use-nondebuggable-when-parsing-secrets
- External calls: require-https-for-external-calls,
  set-timeouts-for-external-calls, do-not-put-credentials-in-urls
- Error handling: avoid-sensitive-data-in-error-messages,
  do-not-swallow-security-errors-silently
- Extensibility: do-not-expose-sensitive-data-in-event-publishers

Paired AL samples under samples/security/<slug>/{bad,good}.al, object
IDs 50200-50231 (no overlap with performance 50100-50140).

Rubber-duck findings addressed:
- HttpClient secret-URI: SetSecretRequestUri is on HttpRequestMessage
  (not HttpClient). Rewrote use-secrettext-with-httpclient and its
  good sample to use HttpRequestMessage + HttpClient.Send.
- InherentPermissions only grants access to same-extension objects;
  the sample now defines its own table 50230 "Sec Sample Lookup" and
  grants 'r' on that, not on Database::Customer.
- Reworked compose-secrets-with-secretstrsubstno bad.al away from
  Format(SecretText) (unreliable) to a plain Text+StrSubstNo anti-
  pattern.
- Moved normative guidance out of Description in three articles
  (compose-secrets-..., prefer-azure-key-vault-..., use-inherent-...)
  so it sits in Best Practice / Anti Pattern per READ contract.
- Added a companion helper codeunit (50231) to the indirect-permissions
  good sample so it actually demonstrates the controlled write path.
- Rebuilt the event-publisher good/bad pair on the same ExportCustomer
  scenario so the contrast is the shape of the event signature, not a
  different event.

Also: broaden samples/README.md object-ID range note to 50100-50299.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

samples/security/use-indirect-permissions-for-elevated-access/good.al

@@ -0,0 +1,34 @@
+permissionset 50202 "Sec Sample Elevated Write"
+{
+    Assignable = false;
+    Caption = 'Elevated write via helper (sample)';
+    // Callers hold R directly; the helper codeunit assumes this set and
+    // performs the Modify via indirect permission.
+    Permissions =
+        tabledata "Sales Header" = Rmi;
+}
+
+codeunit 50231 "Sec Sample Elevated Helper"
+{
+    Access = Public;
+    Permissions = tabledata "Sales Header" = Rmi;
+
+    procedure SetExternalDocumentNo(SalesDocType: Enum "Sales Document Type"; SalesDocNo: Code[20]; NewExternalDocNo: Code[35])
+    var
+        SalesHeader: Record "Sales Header";
+    begin
+        ValidateCaller();
+        if NewExternalDocNo = '' then
+            Error('External document number must be provided.');
+        if not SalesHeader.Get(SalesDocType, SalesDocNo) then
+            Error('Sales document not found.');
+        SalesHeader."External Document No." := NewExternalDocNo;
+        SalesHeader.Modify(true);
+    end;
+
+    local procedure ValidateCaller()
+    begin
+        // Verify the caller is permitted to perform this elevated write
+        // (role check, setup flag, approvals, etc.).
+    end;
+}