add serviceEntitlements resource for Microsoft.Security (#45458)

* feat(security): add generic billing plans resource

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor(security): model billing plans as proxy resources

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(security): include billing plans in default package

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(security): add securityEntitlements tracked resource and rename to serviceEntitlements

Introduce the Microsoft.Security/serviceEntitlements ARM tracked resource
(2026-09-01-preview) and finalize naming per ARM review feedback.

Changes:
- Rename resource type billingPlans -> serviceEntitlements across TypeSpec,
  generated Swagger, examples, readme.md and suppressions.yaml.
- Model as a TrackedResource (location + tags) instead of a proxy resource.
- Remove the untyped serviceProperties bag (typed schema to follow) to
  avoid the additionalProperties antipattern.
- Add tenant-scope list at GET /providers/Microsoft.Security/serviceEntitlements
  alongside the subscription and resource-group list operations.
- Use camelCase URL segment (serviceEntitlements) and key
  (serviceEntitlementName); PascalCase models and operationIds.

Validated with tsp compile --warn-as-error, oav validate-spec and
oav validate-example (all pass).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(security): address ARM review feedback on serviceEntitlements

- Remove x-ms-long-running-operation-options via emit-lro-options: none (RPC-Async 6.7)
- PATCH/DELETE 202 now return both Location and Azure-AsyncOperation headers
- Tighten serviceEntitlementName pattern to ^[a-z0-9]{3,24}$ (Storage convention)
- Rename namespace to ServiceEntitlementsApi and drop casing-style suppression
- Add use-read-only-status-schema for provisioningState
- Lowercase example resource names to match name pattern

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(security): add self-hosted operationResults endpoint for serviceEntitlements

Add a GET .../serviceEntitlements/{serviceEntitlementName}/operationResults/{operationId}
returning common-types OperationStatusResult, so async operation status is served by
this resource type's own instance instead of the shared Microsoft.Security operationStatuses
endpoint (owned by a different service). Mirrors the governanceRules and securityConnectors
devops operationResults precedents.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(security): resolve LintDiff errors on serviceEntitlements

- Add x-ms-pageable to the manually-routed listByTenant operation (XmsPageableForListCalls / RPC-Get-V1-13)
- Add name pattern to serviceEntitlementName path param on operationResults (ResourceNameRestriction / RPC-Uri-V1-05)
- Use common-types OperationIdParameter for the operationId path param

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* style(security): apply tsp format to ServiceEntitlement.tsp

Fixes TypeSpec Validation format check (no functional/swagger change).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(security): remove non-functional AutoRest MULTIPLE_API_VERSION directive

Avocado ignores AutoRest directives; MULTIPLE_API_VERSION on the composite
default tag is a pre-existing, intentional condition handled via the
Approved-Avocado override label, not a readme directive.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(security): emit x-ms-pageable natively via @list instead of @extension

Replaces the @extension x-ms-pageable decorator on listByTenant with the
@list + @listsResource constructs. The @typespec/openapi @extension approach
tripped the typespec-azure-core no-openapi-client-extensions rule (error).
Using @list makes the autorest emitter recognize the paging operation and emit
x-ms-pageable natively; generated swagger is unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix async LRO example polling headers to reference nested operationResults

Update Azure-AsyncOperation/Location headers in the Create (201), Update (202),
and Delete (202) examples to point at the self-hosted, resource-nested
operationResults endpoint that the spec actually defines, instead of a
location-scoped operationStatuses path that does not exist in this API.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(security): address remaining service entitlement feedback

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* feat(security): promote service entitlements to stable

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Revert "feat(security): promote service entitlements to stable"

This reverts commit 782f1902f0662816579930669090eded6737d3d1.

* fix(security): remove tenant service entitlement list

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Gangadhar K <29989872+gangaken@users.noreply.github.com>