New Group Policy - COM vs CLI

Description of the new feature / enhancement

As an enterprise administrator I want to be able to control access to the WinGet CLI, PowerShell Module, and COM APIs.

This will allow me to control the WinGet CLI and the WinGet PowerShell module (as a single interface). This will allow me to control the WinGet COM APIs (as a single interface).

The typical scenarios I want to enable are:

1. Users cannot call winget via the CLI or the PowerShell module, but I can still call winget via Intune or another MDM application.
2. Users can call winget via the CLI or the PowerShell module, but I can still call winget via Intune or another MDM application.
3. WinGet is entirely disabled both for users via the CLI, the PowerShell module, and the COM APIs.
4. WinGet is available for users via the CLI or PowerShell, but the COM APIs are restricted for other applications.

Proposed technical implementation details

No response

No files, tests, or entry points are named. Begin by locating the WinGet CLI, PowerShell module, and COM API access-policy entry points, then clarify how the four requested access scenarios should be represented. Done requires an agreed implementation plan and tests covering the separate CLI/PowerShell and COM controls.