fix(orca): correct domain policy evaluation and align checks with upstream ORCA

[TuEye]

Fixes ORCA226/227 domain coverage checks by evaluating the corresponding policy rules instead of policy objects, including rule state and exclusions.

Also updates ORCA230–232 to use rule-based evaluation and align the result logic with upstream ORCA. The checks now focus on whether multiple enabled custom rules target the same domain, while respecting domain exclusions. No matching custom rule is treated as valid, while overlapping rules are reported as informational.

Because upstream ORCA treats the absence of a matching custom policy as valid — the default protection still applies — these checks do not represent a high-risk failure condition in that scenario. For that reason, I also reduced the risk rating from High to Medium.

Tests:

• Verified the affected ORCA checks against live tenant data
• PSScriptAnalyzer against the changed files
• All Pester tests with Invoke-CippTests.ps1

Small note: The Pester test is currently failing in Invoke-AddUser.Tests.ps1 because Get-Tenants is not available in the test context. From what I can see, this is unrelated to the changes in this PR

closes #586