Promote security knowledge from community to Microsoft layer (#49)

* Promote security knowledge from community to Microsoft layer

Pure git-mv relocation of the SECURITY domain from the community layer to the Microsoft layer. No content changes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address review feedback on security knowledge promotion

- do-not-grant-rights-beyond-a-users-entitlement.md: drop the See sample
  reference to a .good.al file that does not exist
- Remove the 'Contributions welcome' boilerplate line from
  compose-permission-sets, prefer-oauth2, and protect-sensitive-data
- protect-sensitive-data-in-temporary-tables: remove the pointless
  DeleteAll on the locally scoped temp buffer in the good sample and
  reword Best Practice to note local buffers are cleaned up automatically
- Drop guard-bulk-operations-with-istemporary from the promotion; it
  stays in the community layer pending a decision on whether it is security

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Remove Contributions welcome boilerplate from do-not-grant article for consistency

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Jesper Schulz-Wedde <jesper.schulzwedde@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

microsoft/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.good.al

@@ -0,0 +1,44 @@
+codeunit 50100 "Partner API Client"
+{
+    procedure FetchOrders(var Response: Text): Boolean
+    var
+        OAuth2: Codeunit OAuth2;
+        HttpClient: HttpClient;
+        HttpRequest: HttpRequestMessage;
+        HttpResponse: HttpResponseMessage;
+        AccessToken: SecretText;
+        Scopes: List of [Text];
+    begin
+        Scopes.Add('https://partner.example.com/.default');
+
+        // Client-credentials flow for service-to-service. Tokens expire and rotate
+        // on their own schedule; secret and client id are retrieved from IsolatedStorage.
+        if not OAuth2.AcquireTokenWithClientCredentials(
+                 GetClientIdFromIsolatedStorage(),
+                 GetClientSecretFromIsolatedStorage(),
+                 'https://login.example.com/tenantid/oauth2/v2.0/token',
+                 '',
+                 Scopes,
+                 AccessToken)
+        then
+            exit(false);
+
+        HttpRequest.SetRequestUri('https://partner.example.com/orders');
+        HttpRequest.Method('GET');
+        HttpRequest.GetHeaders().Add('Authorization', SecretStrSubstNo('Bearer %1', AccessToken));
+
+        if not HttpClient.Send(HttpRequest, HttpResponse) then
+            exit(false);
+
+        HttpResponse.Content.ReadAs(Response);
+        exit(HttpResponse.IsSuccessStatusCode);
+    end;
+
+    local procedure GetClientIdFromIsolatedStorage(): Text
+    begin
+    end;
+
+    local procedure GetClientSecretFromIsolatedStorage(): SecretText
+    begin
+    end;
+}