Security: verify downloaded remediation tools

[JayRHa]

Summary

• add SHA-256 validation for downloaded DelProf and SetACL binaries
• remove downloaded binaries when hash validation fails
• call SetACL through an explicit verified path instead of direct path execution

Verification

• pwsh parse check for updated remediation scripts
• Invoke-ScriptAnalyzer focused security rules: PSAvoidUsingInvokeExpression, PSAvoidUsingConvertToSecureStringWithPlainText, PSAvoidUsingPlainTextForPassword
• git diff --check