feat(reporting): expand settings report and add CA documentation

- Export-SettingsReport.py: add coverage for Compliance V2, Endpoint
  Security, Device Management Intents, ADMX, scripts (base64 decoded),
  App Protection/Configuration, updates, enrollment, Autopilot, W365,
  filters, and more; add OMA-URI and customSettings expansion
- Start-IntuneToolkit.ps1: add menu item 19 for Conditional Access
  documentation
- Add Invoke-ConditionalAccessDocumentation.ps1 for CA policy docs
  (CSV/Excel)
- .gitignore: exclude CA documentation CSV/XLSX outputs
- CHANGELOG: document the new reporting capabilities

Start-IntuneToolkit.ps1

@@ -308,6 +308,7 @@ $commonParams = @{
 }
 
 $menuItems = @(
+    "19. Document Conditional Access policies"
     "18. Rotate app secret"
     "17. Deploy CIS M365 baseline"
     "16. Generate reports"
@@ -513,6 +514,24 @@ while($true)
         continue
     }
 
+    if($choiceNumber -eq 19)
+    {
+        $caScript = Join-Path $projectRoot "Scripts/Invoke-ConditionalAccessDocumentation.ps1"
+        $ans = Read-Host "Export to Excel as well? [y/N]"
+        $doExcel = $ans -like 'y*'
+        $caParams = @{}
+        if($doExcel)
+        {
+            $caParams.ExportExcel = $true
+            $xlPath = Read-Host "Excel output path (Enter for default: Scripts/ConditionalAccessDocumentation.xlsx)"
+            if(-not [string]::IsNullOrWhiteSpace($xlPath)) { $caParams.ExcelPath = $xlPath }
+        }
+        & $caScript @caParams
+        Write-Host "`nPress any key to return to the menu..." -ForegroundColor DarkGray
+        $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
+        continue
+    }
+
     if(-not $script)
     {
         continue