refactor: Bump pre-commit and remediate checkov warnings

[acelebanski]

Description

pre-commit version bumped from 3.6.0 to 3.7.0
tlfint version bumped from 1.83.0 to v1.88.4
checkov version bumped from 2.4.22 to 3.2.50

The following checkov checks have been addressed:

Check: CKV_AZURE_44: "Ensure Storage Account is using the latest version of TLS encryption"

• Skipped as we use TLSv1.2 as the default value but we allow the user to lower it on his responsibility.

Check: CKV_AZURE_50: "Ensure Virtual Machine Extensions are not Installed"

• Added a property disabling VM Extensions by default.

Check: CKV2_AZURE_41: "Ensure storage account is configured with SAS expiration policy"

• Opened a separate issue for that Track CKV2_AZURE_41 issue #34.

Check: CKV2_AZURE_38: "Ensure soft-delete is enabled on Azure storage account"

• Enabled soft delete with Azure default values (7 days retention period).

Check: CKV2_AZURE_40: "Ensure storage account is not configured with Shared Key authorization"

• Skipped as we need Shared Key authorization to interact with File Storage API (Terraform still doesn’t support using AzureAD instead, only Blob & Queue Storage types supported).

Check: CKV2_AZURE_47: "Ensure storage account is configured without blob anonymous access"

• Disabled blob anonymous access for all storage accounts created with this module.

Check: CKV2_AZURE_39: "Ensure Azure VM is not configured with public IP and serial console access"

• Skipped as we don’t enable boot diagnostics on VM-Series & Panorama modules by default but we allow the user to enable it on his responsibility (I didn’t touch virtual machine module since it’s legacy and not subject to the refactor).

Check: CKV_GHA_7: "The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. “

• Skipped similarly to AWS repo.

Check: CKV2_GHA_1: "Ensure top-level permissions are not set to write-all"

• Set permission to “read” for help-command.

Motivation and Context

So the refactor supports newest pre-commit version together with its dependencies.

How Has This Been Tested?

I deployed some of the relevant examples.

Types of changes

• New feature (non-breaking change which adds functionality)

Checklist

• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes if appropriate.
• All new and existing tests passed.