Harden amlsecscan scheduled entrypoint ownership

[nlydick]

Summary

Hardens the Azure ML Compute Instance security scanner installation layout so scheduled root execution does not depend on files in a user-owned directory.

This change:

• Keeps the scanner execution directory and cron entrypoint root-owned.
• Installs a root-owned copy of amlsecscan.py and has run.sh execute that trusted copy.
• Keeps config.json root-owned and world-readable.
• Moves generated scan artifacts to /var/lib/amlsecscan.
• Adds regression coverage for the hardened install layout.
• Updates scanner documentation with the new installed layout.

Validation

python -m py_compile .\setup\setup-ci\security-scanner\amlsecscan.py
python -m pytest .\setup\setup-ci\security-scanner\tests\test_amlsecscan.py

Result: 11 passed, 2 skipped.

[nlydick]

kingernupur This PR is approved on the current head (9c711caefbb8065d7b49a431dfeec3cc3cf67ef4), all required checks are green, and GitHub reports it CLEAN/MERGEABLE. My nlydick account has READ access to the upstream repo and GitHub rejected both direct merge and auto-merge. Could you please squash-merge it?