fix: correct service flags so -WSUS actually respects WSUS

[kbaker827]

Summary

• Fixes the -WSUS parameter having no effect: the scanner was returning non-approved updates even when -WSUS was specified
• Swaps the service flags: -WSUS now calls Get-WindowsUpdate with no service flag (so the WU Agent routes through the WSUS server configured by Group Policy), and the default (no -WSUS) now uses -MicrosoftUpdate to query Microsoft's full catalog

Root cause

The original code called Get-WindowsUpdate -WindowsUpdate when -WSUS was specified. In PSWindowsUpdate, -WindowsUpdate explicitly requests service ID 9482F4B4-E343-43B6-B170-9A65BC822C77 (the online Windows Update service), which bypasses WSUS filtering entirely and returns all Microsoft-hosted updates regardless of approval status.

The correct approach for WSUS is to call Get-WindowsUpdate with no service flag. The Windows Update Agent then uses whatever service is configured by Group Policy — which is the WSUS server when the machine is WSUS-managed.

Change

  If ($WSUS) {
-     $GWU = Get-WindowsUpdate -WindowsUpdate
+     # No service flag: WU Agent uses the GPO-configured service (WSUS)
+     $GWU = Get-WindowsUpdate
  }
  Else {
-     $GWU = Get-WindowsUpdate
+     # -MicrosoftUpdate queries Microsoft's catalog directly, bypassing WSUS
+     $GWU = Get-WindowsUpdate -MicrosoftUpdate
  }

Test plan

• Run scanner with -WSUS on a machine pointing to a WSUS server — confirm only WSUS-approved updates are returned
• Run scanner without -WSUS — confirm all available updates are returned (including those not in WSUS)
• Run on a non-WSUS machine — confirm default behavior is unchanged

Closes #109