Add shared CompanyMetadata data source for report layouts

[v-mortenr]

Work item: AB#640703

Adds a shared CompanyMetadata data source so report layouts can bind one shared company block instead of each report hand-coding Company Information fields.

What

• ReportManagement subscribes to the platform GetCompanyMetadata business event and populates the shared company block (name, formatted address repeater, phone/fax/email/home page, bank details, VAT/registration/giro, logo) from Company Information.
• New Company Metadata Builder codeunit (Access = Internal): typed setters centralize the wire keys so the subscriber never hand-writes raw key strings; includes the address-line repeater and the paired field captions.
• CompanyDisplayName is sourced from the Company record (CompanyProperty.DisplayName(), falling back to CompanyName()) to match how the platform builds ReportRequest — not Company Information "Name 2".
• Empty-safe: absent Company Information fields emit present-but-empty values.
• Adds Tests-Report coverage for values, captions, the display-name source, empty-safe behavior, and the address repeater.

[github-actions]

Copilot PR Review

Iteration 2 · Outcome: completed

All four applicable sub-skills (performance, security, privacy, style) completed and evaluated their worklists with no findings. al-upgrade-review and al-ui-review returned not-applicable: the diff touches no upgrade/install/schema/enum surface and contains no page, pageextension, pagecustomization, or control add-in files.

Knowledge source: https://github.com/microsoft/BCQuality@822cae1b2771ac25f665f73369f69093bd4fd630

Sub-skills skipped

• al-upgrade-review — not-applicable
• al-ui-review — not-applicable

Orchestrator pre-filter (13 file(s) excluded)

• layer-disabled (knowledge) : 13 file(s)

_{Findings produced by the Copilot CLI agent against BCQuality at 822cae1b2771ac25f665f73369f69093bd4fd630. Reply 👎 on any inline comment to flag false positives.}

[github-actions]

$\textbf{🟠\ High\ Severity\ —\ Security}$

GetCompanyMetadata declares [InherentPermissions(PermissionObjectType::TableData, Database::"Company Information", 'r')] as its only inherent grant, but the body's transitive call chain reads more than Company Information. PopulateFromCompanyInformation calls FormatAddress.Company(AddrArray, CompanyInfo), which calls the shared FormatAddr helper; when Company Information's Country/Region Code is blank it reads General Ledger Setup (GetGLSetup -> GLSetup.Get()), and when it is set it reads Country/Region (Country.Get(CountryCode)). Neither table is covered by the declared InherentPermissions, so a caller whose own permission set lacks read access to Country/Region or General Ledger Setup will hit a permission error inside this 'empty-safe' procedure. This is a new, unconditional cost: GetCompanyMetadata is wired as a static EventSubscriber on the platform's GetCompanyMetadata event, so it now runs on every report execution across the system (not just reports that previously called FormatAddress.Company), extending the permission surface report generation depends on. Align the InherentPermissions attribute with the procedure's actual transitive reads (add Country/Region and General Ledger Setup 'r', or restructure so FormatAddress's own permission needs are declared where the read happens).

Knowledge:

• microsoft/knowledge/security/inherent-permissions-minimal-grant.md

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.15.4}