fix(tailscale): remove empty groupByEntities from all 24 analytic rules

Resolves the ARM-TTK "Template Should Not Contain Blanks" failure
v-shukore flagged locally with test-AzTemplate (20+ "Empty property: []"
errors at Column 39, same failure class as the ApiKeyIdentifier: "" bug
on the UniFi PR).

Root cause: every rule's incidentConfiguration.groupingConfiguration
block had a literal `groupByEntities: []` line. groupByEntities is only
meaningful when matchingMethod is "Selected" (grouping incidents by
specific entity types); all 24 Tailscale rules use
`matchingMethod: AllEntities`, making the empty array pure inert
boilerplate. Empty arrays aren't in ARM-TTK's default allow-list
(unlike e.g. `defaultValue`, `properties`, `resources`), so the packaged
mainTemplate.json failed on 24 instances - one per rule, at the exact
line numbers in the reviewer's screenshot (4632, 4754, ... 7464).

Why our own CI runs didn't catch this: .script/local-validation/
run-arm-ttk.ps1 explicitly skips "Template Should Not Contain Blanks"
(mirroring .github/actions/entrypoint.ps1's filter list, which the real
upstream GitHub Actions run-arm-ttk check also applies) - so neither our
local wrapper nor the official CI check ever exercised this test. The
reviewer caught it by running Test-AzTemplate directly, without those
filters. Confirmed via the same raw invocation locally: before this
fix, "Template Should Not Contain Blanks" failed with exactly 24 errors;
after, 0.

Also ran the FULL unfiltered ARM-TTK suite (50 tests, no skip list at
all) to make sure nothing else was hiding behind our wrapper's filters.
Only remaining failure: "IDs Should Be Derived From ResourceIDs" - the
known, unavoidable false positive on CCF multi-poller solutions (Mustache
{{...}} placeholders in dataCollectionEndpointId/auth.AppId), already
documented from the UniFi PR and filtered by both our wrapper and the
real upstream CI. Not a regression, not actionable.

Files: groupByEntities: [] line removed from all 24
Analytic Rules/*.yaml. Package/ regenerated and repinned to 3.0.0.

Author: noodlemctwoodle

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleAuthkeycreated.yaml

@@ -37,6 +37,5 @@ incidentConfiguration:
     reopenClosedIncident: false
     lookbackDuration: 5h
     matchingMethod: AllEntities
-    groupByEntities: []
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDeviceAdvertisingSubnetRoutes.yaml

@@ -49,6 +49,5 @@ incidentConfiguration:
     reopenClosedIncident: false
     lookbackDuration: 1d
     matchingMethod: AllEntities
-    groupByEntities: []
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDeviceKeyExpiringSoon.yaml

@@ -41,6 +41,5 @@ incidentConfiguration:
     reopenClosedIncident: false
     lookbackDuration: 1d
     matchingMethod: AllEntities
-    groupByEntities: []
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDeviceSshNewlyEnabled.yaml

@@ -50,6 +50,5 @@ incidentConfiguration:
     reopenClosedIncident: false
     lookbackDuration: 1d
     matchingMethod: AllEntities
-    groupByEntities: []
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDnsNameserversModified.yaml

@@ -41,6 +41,5 @@ incidentConfiguration:
     reopenClosedIncident: false
     lookbackDuration: 1d
     matchingMethod: AllEntities
-    groupByEntities: []
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleExitnodeadvertisedorapproved.yaml

@@ -40,6 +40,5 @@ incidentConfiguration:
     reopenClosedIncident: false
     lookbackDuration: 5h
     matchingMethod: AllEntities
-    groupByEntities: []
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleExternalDeviceAdded.yaml

@@ -48,6 +48,5 @@ incidentConfiguration:
     reopenClosedIncident: false
     lookbackDuration: 1d
     matchingMethod: AllEntities
-    groupByEntities: []
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleMagicDnsDisabled.yaml

@@ -38,6 +38,5 @@ incidentConfiguration:
     reopenClosedIncident: false
     lookbackDuration: 1d
     matchingMethod: AllEntities
-    groupByEntities: []
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleMasscredentialrevocationinshortwindow.yaml

@@ -43,6 +43,5 @@ incidentConfiguration:
     reopenClosedIncident: false
     lookbackDuration: 5h
     matchingMethod: AllEntities
-    groupByEntities: []
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleNewAPIaccesstokenorOAuthclientcreated.yaml

@@ -38,6 +38,5 @@ incidentConfiguration:
     reopenClosedIncident: false
     lookbackDuration: 5h
     matchingMethod: AllEntities
-    groupByEntities: []
 kind: Scheduled
 version: 1.0.0