fix(ca-exporter): pre-fetch auth context class references to fix ID resolution

Replaced per-policy Graph API calls with a single pre-fetch of all
authentication context class references into a hashtable, consistent
with every other lookup in the script. Also fixes silent ID drops when
DisplayName was missing — GetOrDefault now falls back to the raw ID.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Scripts/Invoke-ConditionalAccessDocumentation.ps1

@@ -393,6 +393,14 @@ try {
     $termsOfUseAgreements = @{}
 }
 
+# Authentication context class references
+try {
+    $authContextClassReferences = Get-MgIdentityConditionalAccessAuthenticationContextClassReference -All -ErrorAction Stop | Group-Object -Property Id -AsHashTable
+} catch {
+    Write-Warning "Authentication context class references could not be retrieved. Context names will not be resolved."
+    $authContextClassReferences = @{}
+}
+
 # GSA network filtering profiles
 try {
     $networkFilteringProfiles = Invoke-MgGraphRequest -Uri 'https://graph.microsoft.com/beta/networkAccess/filteringProfiles' -Method GET -OutputType PSObject -ErrorAction Stop |
@@ -441,15 +449,8 @@ foreach ($policy in $conditionalAccessPolicies) {
         @($policy.Conditions?.ClientApplications?.IncludeServicePrincipals) | ForEach-Object { $includeServicePrincipals.Add($servicePrincipals.GetOrDefault($_, $_)) }
         @($policy.Conditions?.ClientApplications?.ExcludeServicePrincipals) | ForEach-Object { $excludeServicePrincipals.Add($servicePrincipals.GetOrDefault($_, $_)) }
 
-        $includeAuthenticationContext = [System.Collections.Generic.List[Object]]::new()
+        $includeAuthenticationContext = @($policy.Conditions?.Applications?.IncludeAuthenticationContextClassReferences) |
-        @($policy.Conditions?.Applications?.IncludeAuthenticationContextClassReferences) | ForEach-Object {
+            ForEach-Object { $authContextClassReferences.GetOrDefault($_, $_) }
-            try {
-                $context = Get-MgIdentityConditionalAccessAuthenticationContextClassReference -Filter "Id eq '$PSItem'" -ErrorAction Stop
-                if ($context.DisplayName) { $includeAuthenticationContext.Add($context.DisplayName) }
-            } catch {
-                $includeAuthenticationContext.Add($PSItem)
-            }
-        }
 
         $includeLocations = @($policy.Conditions?.Locations?.IncludeLocations) | ForEach-Object { $namedLocations.GetOrDefault($_, $_) }
         $excludeLocations = @($policy.Conditions?.Locations?.ExcludeLocations) | ForEach-Object { $namedLocations.GetOrDefault($_, $_) }