Backport #543: use SQL per-service SID for folder ACLs (vm_mssql_win)

[doherty100]

Closes #549

Summary

Backports theme A of PR #543 into the production modules/vm-mssql-win scripts. Grant-SqlFullControl in Set-MssqlConfiguration.ps1 previously queried the MSSQLSERVER service's logon account (Get-CimInstance … StartName) and granted that account FullControl on the freshly created SQL data ($sqlPath) and errorlog ($sqlErrorlogPath) directories.

This change grants FullControl to the Database Engine per-service SID NT SERVICE\MSSQLSERVER instead. The per-service SID:

• is present in the service process token regardless of the configured logon account,
• survives service-account changes, and
• matches the permissions the SQL Server installer applies to its data directories.

The grant remains non-destructive (SetAccessRule, inheritance preserved), on directories that are freshly created immediately before the call → low risk.

Out of scope (from PR #543)

Theme	Verdict	Why
B — inheritance disable + clean-slate ACEs	Deferred	Targets live data/errorlog dirs; needs a deploy + Invoke-UnitTests.ps1 -Module vm_mssql_win -Integration cycle first.
C — C:\Scripts lockdown	N/A	CustomScriptExtension delivery; no user-writable C:\Scripts.
D — encoding/em-dash fix	N/A	Module scripts already ASCII-clean.
E — README	N/A	README documents task identity, not the folder-ACL service account.

Validation

• PSScriptAnalyzer (CI settings, -Severity Error,Warning): no issues.
• Non-ASCII scan of edited file: clean.

Reference

• Configure File System Permissions for Database Engine Access

[doherty100]

✅ Deploy + integration test validation — PASS

Applied vnext (which contains this merged change) to a live sandbox and ran the full vm_mssql_win unit + integration suite. The patched Grant-SqlFullControl (per-service SID NT SERVICE\MSSQLSERVER) executed as part of the configure_sql_server CustomScriptExtension without error.

terraform apply

Apply complete! Resources: 26 added, 3 changed, 3 destroyed. — configure_sql_server extension completed in 5m55s (this is the step that runs Set-MssqlConfiguration.ps1 → Grant-SqlFullControl on the freshly-created M:\MSSQL\DATA and L:\MSSQL\LOG directories).

Tests: Invoke-UnitTests.ps1 -Module vm_mssql_win -Integration

UNIT TEST RESULTS SUMMARY
  [PASS] vm-mssql-win: Passed=25 Failed=0
  [PASS] integration: SQL: jumpwin1 -> mssqlwin1: Passed=1 Failed=0
Overall: Passed=26 Failed=0 Total=26
RESULT: PASS

Relevant checks directly exercising the ACL'd SQL data/log directories (all PASS):

• SQL Connectivity: Connected to instance mssqlwin1
• SQL Config: system db data files on M: / log files on L:
• SQL Smoke Test: created unittestdb — data on M:, log on L:
• SQL Service: MSSQLSERVER + SQLSERVERAGENT running
• Integration: jumpwin1 → mssqlwin1 SQL auth as MYSANDBOX\bootstrapadmin (sysadmin)

The SQL Server engine (running under its per-service SID identity) successfully created and wrote database files in the directories granted FullControl by the refactored function, confirming the per-service SID grant is functionally correct.

Environment

• Branch/base: vnext @ 871b0b9 (this PR's squash-merge commit)
• Enabled modules: vnet_shared, vnet_app, vm_mssql_win
• All VMs (adds1, jumpwin1, mssqlwin1) confirmed running before tests (DC up).