aadsshlogin-selinux policy does not cover RHEL 10 sshd-session domain (sshd_session_t) — Entra login provisioning fails under enforcing SELinux

### Description
On RHEL 10 with SELinux in enforcing mode, Microsoft Entra ID (AAD) SSH login fails
during user provisioning even though `aadsshlogin` and `aadsshlogin-selinux` are
installed. The shipped SELinux policy grants the required permissions to the classic
sshd domain (`sshd_t`), but RHEL 10 ships the newer OpenSSH that performs per-session
work (including the PAM `account`/provisioning phase) in a **separate `sshd-session`
process running in the `sshd_session_t` domain**. The vendor policy has no rules for
`sshd_session_t`, so provisioning (`aaduseradd`, editing passwd/shadow, `aadpasswd_file_t`,
etc.) is denied.

### Environment
- OS: RHEL 10.2 (Azure Marketplace / golden image), SELinux enforcing
- Packages:
- `aadsshlogin-1.0.034210009-1.x86_64`
- `aadsshlogin-selinux.x86_64`
- OpenSSH: the RHEL 10 build with the `sshd-session` privilege-separation split

### Symptoms (journal)
```
pam_aad(sshd:account): First call for @. Provisioning user data.
pam_aad(sshd:account): Process exit failure: Permission denied
pam_aad(sshd:account): User provisioning failed with error code -1
sshd-session: fatal: mm_request_send: write: Bad file descriptor
```

### Root cause (SELinux AVC)
```
avc: denied { execute } for comm="sshd-session" name="aaduseradd"
scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023
tcontext=system_u:object_r:useradd_exec_t:s0 tclass=file permissive=0
```

The policy allows this for `sshd_t` but not `sshd_session_t`:
returns an allow:
```
sesearch -A -s sshd_t -t useradd_exec_t -c file -p execute
```

returns nothing (the gap):
```
sesearch -A -s sshd_session_t -t useradd_exec_t -c file -p execute
```

### Full set of denials (from a permissive-mode login capture)
`sshd_session_t` needs the same access the vendor policy currently grants only to
`sshd_t`, against these types: `useradd_exec_t`, `groupadd_exec_t`, `sssd_exec_t`
(execute/execute_no_trans/map), `passwd_file_t`, `shadow_t`, `etc_t`,
`aadpasswd_file_t` (create/rename/setattr/write/unlink), and `home_root_t`,
`user_home_dir_t`, `user_home_t` (create/setattr/write) for home-dir creation.

### Impact
Entra ID SSH login is broken on RHEL 10 under enforcing SELinux unless customers ship
their own supplementary policy module for `sshd_session_t`. This affects any CIS/STIG
hardened RHEL 10 image (SELinux enforcing is required).

### Suggested fix
Update `aadsshlogin-selinux` to grant the existing AAD provisioning rules to
`sshd_session_t` in addition to `sshd_t` on RHEL 10 (or detect the OpenSSH
`sshd-session` split and apply the rules to the active session domain).

### Workaround
Load a supplementary policy module that re-grants the AAD provisioning permissions to
`sshd_session_t` (built via `audit2allow` from the captured denials).

Start by locating the aadsshlogin-selinux policy rules that grant provisioning access to sshd_t, then compare them with the listed sshd_session_t denials on an enforcing RHEL 10 system. Done means Entra SSH login provisioning succeeds without those AVC denials, including user and home-directory creation.

Written by the indexing model from the issue text.