build: Add a 1ES Pipeline Templates version of Canary (#20127)

This pipeline runs on our agents, rather than OneBranch's, and doesn't
use all of the OneBranch machinery--which is only required for producing
a vpack that we check into Windows. Since Canary will never be a vpack,
we don't need to worry.

It runs at about twice the speed _and_ we control the build images!

This pull request also adds support for the "Terrapin Retrieval Tool,"
which will allow us to move away from having vcpkg contact remote
servers directly to download source code (and which may become mandatory
even in our OneBranch pipelines.)