feat(query): Add Weak TLS Version query

Author: GeekMasher

ql/src/security/CWE-327/WeakTlsVersion.md

@@ -0,0 +1,27 @@
+# Weak TLS Version
+
+This query detects Azure resources that are configured to use weak or deprecated TLS versions, such as TLS 1.0 or TLS 1.1. Using outdated TLS versions exposes services to known vulnerabilities and increases the risk of data breaches or man-in-the-middle attacks. It is a security best practice to require the latest supported TLS version (such as TLS 1.2 or higher) for all resources.
+
+## Bad Example: Weak TLS Version Configured
+
+```bicep
+resource db 'Microsoft.Sql/servers@2021-02-01-preview' = {
+  name: 'weaktlsdb'
+  location: 'eastus'
+  properties: {
+    minimalTlsVersion: '1.0' // BAD: Weak TLS version
+  }
+}
+```
+
+## Good Example: Strong TLS Version Configured
+
+```bicep
+resource db 'Microsoft.Sql/servers@2021-02-01-preview' = {
+  name: 'securetlsdb'
+  location: 'eastus'
+  properties: {
+    minimalTlsVersion: '1.2' // GOOD: Strong TLS version
+  }
+}
+```

ql/src/security/CWE-327/WeakTlsVersion.ql

@@ -0,0 +1,19 @@
+/**
+ * @name Weak TLS Version
+ * @description Weak TLS versions (1.0 and 1.1) should not be used as they are considered insecure.
+ * @kind problem
+ * @problem.severity error
+ * @security-severity 8.0
+ * @precision high
+ * @id bicep/weak-tls-version
+ * @tags security
+ *       bicep
+ *       azure
+ *       cryptography
+ */
+import bicep
+
+from Cryptography::WeakTlsVersion resource
+where
+    resource.hasWeakTlsVersion()
+select resource.getWeakTlsVersionProperty(), "Weak TLS version detected"

ql/test/queries-tests/security/CWE-327/WeakTlsVersion/WeakTlsVersion.expected

@@ -0,0 +1 @@
+| app.bicep:18:24:18:28 | String | Weak TLS version detected |

ql/test/queries-tests/security/CWE-327/WeakTlsVersion/WeakTlsVersion.qlref

@@ -0,0 +1 @@
+security/CWE-327/WeakTlsVersion.ql

ql/test/queries-tests/security/CWE-327/WeakTlsVersion/app.bicep

@@ -0,0 +1,21 @@
+
+// Secure
+resource db 'Microsoft.Sql/servers@2021-02-01-preview' = {
+  name: 'securetlsdb'
+  location: 'eastus'
+  properties: {
+    minimalTlsVersion: '1.2' // GOOD: Strong TLS version
+  }
+}
+
+// Bad
+resource db 'Microsoft.Sql/servers@2021-02-01-preview' = {
+  name: 'publicdbserver'
+  location: 'eastus'
+  properties: {
+    version: '12.0'
+    publicNetworkAccess: 'Enabled' // BAD: Database is publicly accessible
+    minimalTlsVersion: '1.0' // BAD: Weak TLS version
+    sslEnforcement: 'Disabled' // BAD: SSL enforcement is disabled
+  }
+}