Add OneBranch pipeline templates for CI and Release (#925)

* Add OneBranch extends wrappers to CI and release pipelines

- azure-pipelines.yml: extends v2/OneBranch.NonOfficial.CrossPlat.yml
- pipeline-publish.yml: extends v2/OneBranch.Official.CrossPlat.yml
- template-pipeline-stages.yml: remove PreBuildCheck stage (SDL now via
  globalSdl), convert pools to OneBranch syntax (type: linux, isCustom,
  ob_outputDirectory)

OneBranch provides: TSA, CredScan, PoliCheck, CodeQL (Python), and
compliance tracking. Release pipeline adds ManualValidation@1 approval
gate before ESRP publish.

Also includes ESRP client ID fix (38d4 -> 384d).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: OneBranch validation - artifact naming and parameter defaults

- Rename PublishPipelineArtifact artifacts to drop_<stage>_<job> convention
- Add default values for packageVersion and publishTarget parameters
- Fixes pipeline queue validation errors

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: use root-relative path for template reference in publish pipeline

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: convert deployment job to regular job for OneBranch compatibility

OneBranch custom Linux pools don't support deployment strategy (runOnce).
Convert to a regular job with explicit artifact download.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* add .config/tsaoptions.json for OneBranch TSA upload

Required by OneBranch SDL pipeline to upload security scan results to TSA.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: remove isCustom pool config, use OneBranch managed pools

1ES PT requires 1ES Hosted Pools for Official templates. Remove isCustom/vmImage
and let OneBranch manage pool selection with just 'type: linux'.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: replace PublishPipelineArtifact with ob_outputDirectory copy

OneBranch auto-publishes artifacts from ob_outputDirectory at job end.
Explicit PublishPipelineArtifact tasks are not allowed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: restore isCustom pool config - required for MS-hosted agents

Without isCustom, OneBranch tries to run in a container using
LinuxContainerImage variable which isn't configured. isCustom: true
tells OneBranch to use MS-hosted agents directly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* retrigger CI

* retrigger CI

* Add debug parameter for system.debug verbose logging

* Fix packageVersion default: use empty string instead of space

* Add PostAnalysis task to break build on PoliCheck failures

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>