Resolves#45644
Bring the macOS CIS benchmark policies up to the current CIS releases:
- macOS 14 Sonoma: v3.0.0 -> v3.1.0
- macOS 15 Sequoia: v2.0.0 -> v2.1.0
- macOS 26 Tahoe: v1.0.0 -> v1.1.0
Policy changes:
- 2.7.1: rescope the screen saver hot corners check to the current
console user and move it to Level 1, per the updated CIS audit.
- 3.4: relax audit log retention to >= 30 days (no size requirement);
parse the day value anchored to `expire-after:` so a mixed directive
such as `7d OR 30d` is correctly rejected.
- 5.1.7: exclude the non-accessible /Library/AppStore directory and its
descendants from the world-writable Library check.
- 5.6: update for the new secure-token audit (verify root has no
AuthenticationAuthority).
- 5.3.1: add the internal APFS volume encryption check (Manual ->
Automated) on macOS 26; remove the deprecated CoreStorage 5.3.2 check
on macOS 14/15.
- 2.10.1: correct the screen saver inactivity threshold to <= 900s
(15 minutes) to match the CIS audit.
Limitations documented (no reliable fleetd data source):
- 5.3.2 (external APFS/HFS+ encryption): apfs_volumes exposes no
internal/external indicator.
- 5.3.3 (FAT32/ExFAT): CIS Manual audit.
Juan Fernandez
e83c2689f5