Added minimal permissions for 'teams app' commands. Closes #7519

[OwnOptic]

Adds the Permissions section to the six teams app command pages, per #7519.

I do not have Dev Proxy wired to a tenant, so I read the API calls out of the command source and then read the Graph permission table for each one. The calls are GET /appCatalogs/teamsApps for list and for every --name lookup, POST /appCatalogs/teamsApps for publish, PUT /appCatalogs/teamsApps/{id} for update, DELETE /appCatalogs/teamsApps/{id} for remove, a POST to /teams/{id}/installedApps or /users/{id}/teamwork/installedApps for install, DELETE /teams/{id}/installedApps/{id} for uninstall, and GET /users/{id} through entraUser.getUpnByUserId when install is given --userId.

Three things are worth a note.

list says AppCatalog.Submit, which reads oddly for a read command. That is what Learn marks least privileged for GET /appCatalogs/teamsApps, with AppCatalog.Read.All in the higher privileged column.

publish, update and remove say AppCatalog.ReadWrite.All rather than AppCatalog.Submit. The publish page says Submit "allows you to submit apps for review only, not to publish them to the catalog", and the delete page says you can only use Submit "to delete app definitions in review". The CLI does neither: publish posts without requiresReview, and remove deletes a published app. Update changes an app already in the catalog, so I read it the same way.

install and uninstall say TeamsAppInstallation.ReadWriteForTeam rather than ReadWriteSelfForTeam. The permissions reference describes the Self variant as letting a Teams app install and uninstall itself, which is not what the CLI does. For the user scope the install page says outright you must use TeamsAppInstallation.ReadWriteForUser.

Verified with npm ci and npm run build in docs/, and compared the rendered HTML for these six pages against teams chat message send.

[milanholemans]

Hi @OwnOptic, please respect our way of working and let an issue get assigned to you before working on it. This makes sure multiple people are not working on the same issue and our backlog stays up-to-date.

[OwnOptic]

@milanholemans understood, I should have asked on #7519 before starting. For the rest of #6918 I will ask to be assigned first.