feat(m365): add defender_atp_safe_attachments_policy_enabled security check

[andoniaf]

⚠️ Dependency

This PR should be merged after #9832 or #9833 which include improved error handling for missing Defender ATP cmdlets (logs a WARNING instead of ERROR when the tenant lacks Microsoft Defender for Office 365 licensing).

---

Context

Adds a new security check defender_atp_safe_attachments_policy_enabled for the m365 provider.

Description

This PR adds a new security check for m365:

• Check: defender_atp_safe_attachments_policy_enabled
• Implementation: New check that detects security misconfigurations
• Tests: Unit tests covering pass, fail, and no-resources scenarios

Steps to review

1. Review the check implementation at prowler/providers/m365/services/defender/defender_atp_safe_attachments_policy_enabled/
2. Review the metadata file for correct severity, remediation, and compliance mappings
3. Run the check tests: poetry run pytest tests/providers/m365/services/defender/defender_atp_safe_attachments_policy_enabled/ -v
4. Run the check against a real environment (if possible):

   prowler m365 --check defender_atp_safe_attachments_policy_enabled

Checklist

Community Checklist

• This feature/issue is listed in here or roadmap.prowler.com

• Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

• Review if the code is being covered by tests.

• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings

• Review if backport is needed.

• Review if is needed to change the Readme.md

• Ensure new entries are added to CHANGELOG.md, if applicable.

SDK/CLI

• Are there new checks included in this PR? Yes
  • If so, do we need to update permissions for the provider? Please review this carefully.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[github-actions]

✅ All necessary CHANGELOG.md files have been updated.

[github-actions]

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

[codecov]

Codecov Report

❌ Patch coverage is 93.33333% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.83%. Comparing base (31b53f0) to head (ce47418).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9837      +/-   ##
==========================================
+ Coverage   86.60%   88.83%   +2.22%     
==========================================
  Files         222       94     -128     
  Lines        5645     3565    -2080     
==========================================
- Hits         4889     3167    -1722     
+ Misses        756      398     -358     

Flag	Coverage Δ
prowler-py3.10-azure	?
prowler-py3.10-m365	88.66% <93.33%> (?)
prowler-py3.11-azure	?
prowler-py3.11-m365	88.66% <93.33%> (?)
prowler-py3.12-azure	?
prowler-py3.12-m365	88.83% <93.33%> (?)
prowler-py3.9-azure	?
prowler-py3.9-m365	88.83% <93.33%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
prowler	88.83% <93.33%> (+2.22%)	⬆️
api	∅ <ø> (∅)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🔒 Container Security Scan

Image: prowler:f1da8fb
Last scan: 2026-01-23 13:36:10 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	3
Total	3

3 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

• Review the detailed scan results
• Update affected packages to patched versions
• Consider using a different base image if updates are unavailable

---

📋 Resources:

• Download full report (see artifacts)
• View in Security tab
• Scanned with Trivy