Align CIS baseline with CIS macOS 26 Tahoe v1.1.0

[tonyyo11]

This PR brings the mSCP Tahoe Branch up to date in preparation for The Center for Internet Security Benchmark for macOS Tahoe v1.1.0 pending release. https://workbench.cisecurity.org/benchmarks/24637

CHANGES:

• system_settings_hot_corners_secure: CIS 2.7.1 moved Level 2 -> Level 1; update benchmark ref and add cis_lvl1 tag; add rule to cis_lvl1 baseline
• audit_retention_configure: CIS 3.4 lower retention ODV from '60d OR 5G' to '30d'
• supplemental_cis_manual: track 5.3.1, 5.3.2, 5.3.3 as manual (CIS marks them Automated but provides no automatable remediation)
• system_settings_guest_access_smb_disable: CIS 2.13.2 update check to 'sysadminctl -smbGuestAccess status' matching 'SMB guest access disabled'; fix unchanged
• mscp-data: bump cis_lvl1/cis_lvl2 titles from v1.0.0 to v1.1.0

[tonyyo11]

UPDATE COMMIT & PR
This PR brings the mSCP Tahoe branch up to date in preparation for the Center for Internet Security Benchmark for macOS Tahoe v1.1.0 pending release. https://workbench.cisecurity.org/benchmarks/24637

CHANGES:

• system_settings_hot_corners_secure (CIS 2.7.1): recommendation moved Level 2 -> Level 1. Updated the benchmark reference to 2.7.1 (level 1), added the cis_lvl1 tag, and added the rule to the cis_lvl1 baseline.
• audit_retention_configure (CIS 3.4): lowered the retention ODV for cis_lvl1/cis_lvl2 from 60d OR 5G to 30d to match the revised recommendation ("Ensure Security Auditing Logs Are Retained for 30 Days").
• New rules for CIS 5.3 (Disk Encryption): v1.1.0 marks these Automated, but the benchmark provides no scripted remediation, so each rule audits and reports compliance, with the CIS remediation steps listed in the fix (no enforcement/profile):
  • os_internal_apfs_volumes_encrypted — CIS 5.3.1 (Level 1)
  • os_external_apfs_hfs_volumes_encrypted — CIS 5.3.2 (Level 1)
  • os_fat_exfat_volumes_prohibit — CIS 5.3.3 (Level 2)
    Added to baselines: cis_lvl1 (5.3.1, 5.3.2), cis_lvl2 (5.3.1, 5.3.2, 5.3.3), and cisv8 (all three).
• supplemental_cis_manual: removed the legacy 5.3.1 (APFS) and 5.3.2 (CoreStorage) manual entries, now superseded by the dedicated 5.3.x rules above.
• system_settings_guest_access_smb_disable (CIS 2.13.2): updated the check to /usr/sbin/sysadminctl -smbGuestAccess status matching "SMB guest access disabled"; fix unchanged.
• mscp-data: bumped the cis_lvl1/cis_lvl2 titles from v1.0.0 to v1.1.0.

NOTES:

• The new 5.3.x rules currently populate only the CIS references (benchmark + controls v8: 3.6, 3.11, 13.6, 14.8); the remaining reference fields (CCE, 800-53, CCI, SRG, STIG) are left as N/A for maintainers to fill, per discussion.
• v1.1.0 is still a draft on the CIS Workbench as of this PR

[brodjieski]

Hey @tonyyo11 .. CIS now published the benchmark for Tahoe. Before we pull this in, can you do a final once-over to make sure it's in sync with what was published? Thank again for your assist on this one!

[tonyyo11]

Rules have been updated based on changes between draft and publication. @brodjieski