Improve access review effective entitlement expansion gates

[MAUROCERON]

Implements #1404.

Summary

• Adds an effective entitlement expansion gate before access certification decisions.
• Requires direct entitlement, transitive path, dynamic/birthright source, effective permission, source of authority, certifier visibility, and Not Evaluable handling.
• Adds edge-case fixtures for nested groups, dynamic group rules, inherited cloud IAM bindings, application-local roles, and complete expanded evidence.

Validation

• Markdown fence balance check for touched files.
• Marker checks for AR-EFF rules, transitive path, dynamic/birthright source, effective permission, certifier visibility, Not Evaluable, and the effective entitlement expansion matrix.
• Reference URL checks for Microsoft Graph transitive memberOf, Google Cloud Policy Analyzer, and AWS IAM Access Analyzer unused access.
• Private payment details were not included in files or public issue/PR text.

Payment details can be provided privately after maintainer acceptance.