Remove WhatsApp block rule and deploy Santa profiles to all Workstations Macs (#42285)

## Summary

- **Removed the WhatsApp block rule** from the Santa rules configuration
profile (`santa-rules.mobileconfig`). The rule blocked WhatsApp.app via
a CDHASH identifier (`54a8ec11bcea48a276b1fdce556a29108ba77de4`) and is
no longer needed.
- **Expanded Santa profile deployment to all macOS hosts** on the
Workstations team. Both `santa-configuration.mobileconfig` and
`santa-rules.mobileconfig` were previously scoped only to the `"Santa
test devices"` label (4 specific Macs). Removed the `labels_include_any`
restriction so these profiles now install on all Macs in the
Workstations team.
- **Deleted the "Santa test devices" label entirely.** Removed the label
definition file (`santa-test-devices.yml`), its reference in
`default.yml`, and all remaining `labels_include_any` references to it
from the Santa software entry, install-santa-extension policy, and
collect-santa-denied-logs report.

## Changes

###
`it-and-security/lib/macos/configuration-profiles/santa-rules.mobileconfig`
- Removed the `BLOCKLIST` / `CDHASH` rule entry for WhatsApp.app
(identifier `54a8ec11bcea48a276b1fdce556a29108ba77de4`)
- The allowlist for North Pole Security (Team ID) and the test block
rule for BundleExample.app remain unchanged

### `it-and-security/fleets/workstations.yml`
- Removed `labels_include_any: ["Santa test devices"]` from the
`santa-configuration.mobileconfig` and `santa-rules.mobileconfig`
profile entries
- Removed `labels_include_any: ["Santa test devices"]` from the Santa
software entry
- All Santa-related profiles and software now apply to all macOS hosts
on the Workstations team

### `it-and-security/lib/all/labels/santa-test-devices.yml` (deleted)
- Removed the manual label definition for "Santa test devices"
(previously scoped to 4 specific Macs)

### `it-and-security/default.yml`
- Removed the label path reference to `santa-test-devices.yml`

### `it-and-security/lib/macos/policies/install-santa-extension.yml`
- Removed `labels_include_any: ["Santa test devices"]` so the policy
applies to all macOS hosts

### `it-and-security/lib/macos/reports/collect-santa-denied-logs.yml`
- Removed `labels_include_any: ["Santa test devices"]` so the report
applies to all macOS hosts

---

Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1774320804143629?thread_ts=1774320368.198119&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)

---------

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>

it-and-security/default.yml

@@ -103,7 +103,6 @@ labels:
   - path: ./lib/all/labels/macs-with-1password-installed.yml
   - path: ./lib/all/labels/rpm-based-linux-hosts.yml
   - path: ./lib/all/labels/virtual-machines.yml
-  - path: ./lib/all/labels/santa-test-devices.yml
   - path: ./lib/all/labels/x86-based-windows-hosts.yml
   - path: ./lib/all/labels/apple-silicon-macos-hosts.yml
   - path: ./lib/all/labels/keynote-14-installed.yml

it-and-security/fleets/workstations.yml

@@ -76,11 +76,7 @@ controls:
         labels_include_any:
           - "Macs with 1Password installed"
       - path: ../lib/macos/configuration-profiles/santa-configuration.mobileconfig
-        labels_include_any:
-          - "Santa test devices"
       - path: ../lib/macos/configuration-profiles/santa-rules.mobileconfig
-        labels_include_any:
-          - "Santa test devices"
       - path: ../lib/macos/configuration-profiles/nudge-configuration.mobileconfig
       - path: ../lib/macos/configuration-profiles/microsoft-autoupdate-settings.mobileconfig
         labels_include_any:
@@ -170,8 +166,6 @@ software:
         - Security
     - path: ../lib/macos/software/santa.yml # Santa for macOS
       self_service: true
-      labels_include_any:
-        - Santa test devices
       categories:
         - Security
     - path: ../lib/macos/software/zoom.yml # Zoom for macOS

it-and-security/lib/all/labels/santa-test-devices.yml

@@ -1,9 +0,0 @@
-- name: Santa test devices
-  description: Macs testing santa
-  label_membership_type: manual
-  platform: darwin
-  hosts:
-    - "allens-macbook-pro.local"
-    - "harrisons-macbook-pro.local"
-    - "noah-talerman-macbook-pro.local"
-    - "allens-mac-mini.local"

it-and-security/lib/macos/configuration-profiles/santa-rules.mobileconfig

@@ -34,15 +34,6 @@
 										<key>rule_type</key>
 										<string>BINARY</string>
 									</dict>
-									<dict>
-										<!-- Block WhatsApp.app -->
-										<key>identifier</key>
-										<string>54a8ec11bcea48a276b1fdce556a29108ba77de4</string>
-										<key>policy</key>
-										<string>BLOCKLIST</string>
-										<key>rule_type</key>
-										<string>CDHASH</string>
-									</dict>									
 								</array>
 							</dict>
 						</dict>

it-and-security/lib/macos/policies/install-santa-extension.yml

@@ -6,5 +6,3 @@
   run_script:
     path: ../scripts/install-santa-extension.sh
   platform: darwin
-  labels_include_any:
-    - "Santa test devices"

it-and-security/lib/macos/reports/collect-santa-denied-logs.yml

@@ -7,5 +7,3 @@
   observer_can_run: true
   platform: "darwin"
   query: SELECT * FROM santa_denied;
-  labels_include_any:
-    - Santa test devices