Reason for Proposed Changes

• These queries are meant to detect azurerm network rules that expose sensitive ports: port 22(ssh) and port 3389(rdp), however they are not taking into account azurerm_network_security_group´s.
• This has bestowed upon the queries a massive blind spot for this dangerous vulnerabilities; inside these groups one or both ports could be explicitly exposed.

Proposed Changes

• To allow for complete thorough search for network rules i have implemented an extra valid pattern for the CxPolicy to scan and detect these statements when inside an azurerm_network_security_group block.
• The implementations specifically searches for "security_rule"´s inside groups because that is the singular allowed identifier for rules defined inside these groups. Other identifiers are disregarded. doc
• All the tests have been updated to ensure results are consistent whether rules are defined inside or outside of a group.

Note: The searchKey uses rule names for traceability. This approach was chosen over index-based referencing due to consistent misalignment between idx values and the actual rule objects, which led to duplicate or misplaced warnings.

originalPR

I submit this contribution under the Apache-2.0 license.