Add SharePoint Online API permissions and cert propagation warning

[mckibbenc]

Summary

• Documents the required Entra ID app API permissions (Microsoft Graph + SharePoint) for the Client ID/Certificate service account used in SharePoint Online source groups
• Adds a warning about AADSTS700027 transient errors caused by Entra ID certificate propagation lag after uploading a new certificate
• Fixes two passive-voice sentences flagged by Dale

Test plan

• Vale/Dale auto-fix passes on CI
• Editorial review passes

[github-actions]

Auto-Fix Summary

8 issues fixed, 3 skipped across 1 files

Category	Fixes
Contractions	1
Dale: misplaced-modifiers	1
Dale: passive-voice	5
Dale: wordiness	1

Skipped (needs manual review)	Reason

| docs/accessanalyzer/2601/gettingstarted/sharepoint-online/set-up-source-group.md:19 — Dale: wordiness | 'click Generate and Download Certificate to generate a certificate and download it to your machine' partly restates the button label, but trimming it would drop the detail that the file lands on the local machine. |
| docs/accessanalyzer/2601/gettingstarted/sharepoint-online/set-up-source-group.md:33 — Dale: passive-voice | Permission descriptions such as 'Have full control of all site collections' are Microsoft's verbatim API permission strings; rewording them would break the match with the Azure portal. |
| docs/accessanalyzer/2601/gettingstarted/sharepoint-online/set-up-source-group.md:43 — Dale: passive-voice | The AADSTS700027 text is a verbatim quoted error message and must match what the product returns. |

Ask @claude on this PR if you'd like an explanation of any fix.