fix(tailscale): use ISO 8601 lookbackDuration so rules instantiate

All 24 analytic rules had incidentConfiguration.groupingConfiguration.
lookbackDuration in short form (5h/6h/1d). The V3 packaging tool converts
top-level durations (queryFrequency/queryPeriod/suppressionDuration) to
ISO 8601 but does NOT convert the nested lookbackDuration, so the packaged
mainTemplate shipped short-form values verbatim.

Impact: any customer who installs this solution from Content Hub and
clicks "Create rule" on an analytic-rule template hits a hard save
failure -
  BadRequest: Invalid data model.
  [Properties.IncidentConfiguration.GroupingConfiguration.LookbackDuration:
   The field LookbackDuration must be between PT5M and P7D.]
- because the live alertRules API only accepts ISO 8601 for
lookbackDuration, and the short-form value renders as an empty/invalid
field in the rule wizard. Reproduced end-to-end on a live workspace.

Fix: convert lookbackDuration to ISO 8601 directly in all 24 source
YAMLs (5h -> PT5H, 6h -> PT6H, 1d -> P1D). Since packaging passes the
nested value through unchanged, ISO-in = ISO-out = rules instantiate
cleanly. Verified end-to-end: repackaged, redeployed to a live UK South
workspace, and confirmed all 24 deployed contentTemplates now carry ISO
lookbackDuration (was 24 short / 0 ISO, now 0 short / 24 ISO). All 24
rules were also successfully created as live enabled alertRules from the
converted definitions.

This reverses the earlier short-form change (commit c0089a1) that was
made to satisfy a Copilot advisory. Copilot's claim that ISO "is likely
to fail schema validation" is empirically incorrect: this PR's
DetectionTemplateSchemaValidation was green when the two newest rules
still shipped PT5H/PT6H, and ~200 merged upstream solutions ship ISO
lookbackDuration in their source YAML. Short form is what actually
breaks - at rule-instantiation time, not at packaging time.

Local validation after the change: ARM-TTK 48/48, KQL 56 files PASS,
Field Types / Classic App Insights / Hyperlink PASS. Packaged
mainTemplate.json: 14x P1D + 9x PT5H + 1x PT6H, 0 short-form.

Author: noodlemctwoodle

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleAuthkeycreated.yaml

@@ -35,7 +35,7 @@ incidentConfiguration:
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 5h
+    lookbackDuration: PT5H
     matchingMethod: AllEntities
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDeviceAdvertisingSubnetRoutes.yaml

@@ -47,7 +47,7 @@ incidentConfiguration:
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 1d
+    lookbackDuration: P1D
     matchingMethod: AllEntities
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDeviceKeyExpiringSoon.yaml

@@ -39,7 +39,7 @@ incidentConfiguration:
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 1d
+    lookbackDuration: P1D
     matchingMethod: AllEntities
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDeviceSshNewlyEnabled.yaml

@@ -48,7 +48,7 @@ incidentConfiguration:
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 1d
+    lookbackDuration: P1D
     matchingMethod: AllEntities
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDnsNameserversModified.yaml

@@ -39,7 +39,7 @@ incidentConfiguration:
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 1d
+    lookbackDuration: P1D
     matchingMethod: AllEntities
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleExitnodeadvertisedorapproved.yaml

@@ -38,7 +38,7 @@ incidentConfiguration:
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 5h
+    lookbackDuration: PT5H
     matchingMethod: AllEntities
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleExternalDeviceAdded.yaml

@@ -46,7 +46,7 @@ incidentConfiguration:
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 1d
+    lookbackDuration: P1D
     matchingMethod: AllEntities
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleMagicDnsDisabled.yaml

@@ -36,7 +36,7 @@ incidentConfiguration:
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 1d
+    lookbackDuration: P1D
     matchingMethod: AllEntities
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleMasscredentialrevocationinshortwindow.yaml

@@ -41,7 +41,7 @@ incidentConfiguration:
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 5h
+    lookbackDuration: PT5H
     matchingMethod: AllEntities
 kind: Scheduled
 version: 1.0.0

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleNewAPIaccesstokenorOAuthclientcreated.yaml

@@ -36,7 +36,7 @@ incidentConfiguration:
   groupingConfiguration:
     enabled: true
     reopenClosedIncident: false
-    lookbackDuration: 5h
+    lookbackDuration: PT5H
     matchingMethod: AllEntities
 kind: Scheduled
 version: 1.0.0