Email Security: document internal domains and the Additional internal domains setting

[maximelb]

Adds an Internal Domains page to the Email Security docs.

• Explains message direction (internal / inbound / outbound) and why it matters.
• Explains how your organization's domains are detected: protected mailbox domains, alias and send-as domains from Microsoft 365 SMTP proxy addresses and Google Workspace aliases, and the domain of the mailbox that received the message. No extra permissions are needed.
• Covers the safety rules:
  • shared mailbox providers are never internal;
  • test-google-a.com routing aliases are ignored;
  • your tenant's own *.onmicrosoft.com domain is kept;
  • mail that fails authentication for one of your domains stays inbound.
• Documents the new Additional internal domains setting (scope.internal_domains): when you need it, how it's validated, and YAML/JSON examples. A warning explains that scope.domains limits mailbox coverage and must not be used to mark a domain internal.
• Explains where to see the effective list (Settings → connection card → Internal domains) and what each source label means.

Also links the page from the setup wizard field table (getting-started) and the connection record reference (providers), and adds it to the nav.

mkdocs build --strict and markdownlint-cli2 pass.

🤖 Generated with Claude Code