[Anmol7091]

Summary

accessControlAllowCredential read cors.supportedCredentials, but the Azure API returns
cors.supportCredentials. The check therefore always failed, even when
"Enable Access-Control-Allow-Credentials" was turned on (false positive).

Changes

• plugins/azure/appservice/accessControlAllowCredential.js: read cors.supportCredentials (line 49)
• plugins/azure/appservice/accessControlAllowCredential.spec.js: use the real Azure property name in mock data

Testing

• Azure API response for a Function App with "Enable Access-Control-Allow-Credentials" turned on,
  using the same API version as the collector (2019-08-01):

az rest --method get \
  --url "https://management.azure.com/subscriptions/<subscription_id>/resourceGroups/<resource_group>/providers/Microsoft.Web/sites/<function_app>/config/web?api-version=2019-08-01" \
  --query properties.cors

{
  "allowedOrigins": [
    "https://portal.azure.com"
  ],
  "supportCredentials": true
}

The property is supportCredentials; supportedCredentials is not present in the response.

• Live scan (accuknox/cloudsploit master vs this branch):

App Service	CORS	master	this branch
Function App	Enabled	FAIL	PASS
App Service A	Not enabled	FAIL	FAIL