Minimal permissions for 'spo tenant related' commands

We're adding a new Permissions section to all commands. This section will document the minimal delegated and application permissions required to execute the command.

The goal is to:

• Make it easier to run the CLI with custom app registrations and application permissions.
• Ensure we only document the minimal set of permissions needed.
• Keep documentation consistent by placing the Permissions section right before the Examples section.
• If there are multiple resources, order them alphabetically
• If there are commands that only support one type of auth (like delegated or app-only), we have an example for that as well. E.g. m365 planner tenant settings list - Permissions

Resources

• Writing the docs page
• How to document minimal permissions
• Planner example 1
• Planner example 2

Commands in scope

This issue covers the following commands:

• m365 spo tenant appcatalog add
• m365 spo tenant appcatalogurl get
• m365 spo tenant recyclebinitem list
• m365 spo tenant recyclebinitem remove
• m365 spo tenant recyclebinitem restore
• m365 spo tenant settings list
• m365 spo tenant settings set
• m365 spo tenant site get

Start with the Writing the docs page and the guide on documenting minimal permissions, then review the documentation entries for the eight listed spo tenant commands. Add a Permissions section before Examples for each command, documenting only the minimal delegated and application permissions and ordering multiple resources alphabetically. Done means all listed command pages follow the documented format, including auth-specific examples where needed.