Add Config File Support

[adhilto]

💡 Summary

Add the capability to specify ScubaGoggles parameters via a config file.

Motivation and context

There are some additional parameters that would be useful to add support for via a config file:

• Custom DKIM selectors. GWS, unlike M365, allows you to specify custom DKIM selectors. If an agency uses a custom selector, ScubaGoggles will produce false positives for the DKIM checks, as the API does not currently allow you to determine what the selectors are.
• Top-level OU. In most cases, ScubaGoggles is able to correctly determine the top-level OU, but there are certain edge cases where it can't. It would be useful to allow the users to specify the top-level OU name to cover cases where we can't figure it out.
• "break glass" account names. For common controls, we assert that there should be between 2 and 4 super admin accounts, but note that exceptions are allowed for break class accounts. Unless we allow the users a way to specify the names of the break glass accounts, ScubaGoggles is actually unable to make this exception.
• Groups/OUs allowed to have Sites enabled. The baseline says exceptions can be made on a per-group and per-OU basis, but currently the ScubaGoggles test fails if any OU/group is non-compliant.

There are likely other useful features we could add, but those are the ones that immediately come to mind.

Implementation notes

I recommend mirroring the syntax used on ScubaGear: https://github.com/cisagov/ScubaGear/tree/main/PowerShell/ScubaGear/Sample-Config-Files

Acceptance criteria

• Config file support is added
• Config file support is documented in the readme
• Add Config File Support for Existing Parameters #403
• Add config file support for custom DKIM selectors #347
• Add Config File Support for top-level OU name #348
• Add config file support for break glass accounts #349
• Add config file support for allowing Sites to specific OUs and groups #350
• Add config file support for control omission #351
• Gmail policy 9 - add support to handle IMAP and POP exceptions #296