Drive_Docs Changes to 1.6 and 6.1

[jkaufman-mitre]

🗣 Description

The following changes were made to the Drive_Docs baselines:

• Adjusted Drive_Docs 1.6 to not allow agencies to set access checker to public
• Adjusted Drive_Docs 6.1 to say that agencies SHOULD set Drive for Desktop to authorized devices only
• Added the changes to DRIVEDOCS.3.1v0.2

💭 Motivation and context

Closes #142.
Closes #289.
Closes #302.
Closes #313.

🧪 Testing

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• If applicable, All future TODOs are captured in issues, which are referenced in the PR description.
• The relevant issues PR resolves are linked preferably via closing keywords.
• All relevant type-of-change labels have been added.
• I have read and agree to the CONTRIBUTING.md document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
• Tests have been added and/or modified to cover the changes in this PR.
• All new and existing tests pass.

✅ Pre-merge Checklist

• This PR has been smoke tested to ensure main is in a functional state when this PR is merged.
• Squash all commits into one PR level commit using the Squash and merge button.

✅ Post-merge Checklist

• Delete the branch to clean up.
• Close issues resolved by this PR if the closing keywords did not activate.

[jkaufman-mitre]

Added the changes to DRIVEDOCS.3.1v0.2 into this PR. Fixes #313

[adhilto]

Added the changes to DRIVEDOCS.3.1v0.2 into this PR. Fixes #313

@jkaufman-mitre with regard to #313, please also:

• Clarify the rationale. The current rationale was written through the lens that this setting would apply future security updates as Google releases them.
• Swap out the link that's currently in the resources section for the one I pasted in Clarify GWS.DRIVEDOCS.3.1v0.2 #313, or another one as you see fit. The current one doesn't work ("Sorry, this page can't be found.")

[jkaufman-mitre]

@adhilto Just addressed your changes. Please review.

[adhilto]

Thanks for these changes. A few more comments:

[bnewlin-MITRE]

By not enabling the resource key security update it creates the potential for an unauthorized access to files. Enabling this security update mitigates the risk by ensuring access is controlled properly.

I feel like this is worded vaguely, and there could be a better way to explain what the benefits of the setting entail.

[mdueltgen]

I updated the rationale statement for 3.1. Requesting review

[adhilto]

Baseline looks good and I've implemented the needed changes in the Rego. Just one minor comment about the drift rule, but I'm going to go ahead and approve.