KX-18441 Sign DLLs using short-lived access tokens

[radekpetruska]

Changes the way we access the code signing certificate. Instead of client id/client secret, we use short-lived access tokens.

[Copilot]

Pull request overview

This PR migrates the code signing authentication from a client ID/secret approach to using short-lived access tokens for improved security when signing DLLs via Azure Key Vault.

Changes:

• Replaced Azure Key Vault authentication parameters (tenant-id, client-id, client-secret) with access token authentication in the AzureSignTool command
• Added GetAzureAuthToken task to the Azure DevOps pipeline to obtain short-lived access tokens
• Changed signing condition from opt-out ($(SIGN_FILE) != 'false') to explicit opt-in ($(SIGN_FILE) == 'true')

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
Directory.build.targets	Updated AzureSignTool command to use access token authentication and changed signing condition to explicit opt-in
Directory.Build.props	Removed TimestampServerUrl property definition
.azuredevops/pipelines/build-and-release.yml	Added GetAzureAuthToken task and updated environment variable from AuthenticodeClientSecret to AuthenticodeAccessToken

[Copilot]

The TimestampServerUrl property has been removed from this file, but it is still referenced in Directory.build.targets line 12 as $(TimestampServerUrl) in the AzureSignTool command. This will cause the variable to be undefined during the build process, which could lead to signing failures or missing timestamps on signed assemblies.

Either:

1. Keep the TimestampServerUrl property definition here, or
2. Define it in the Azure DevOps pipeline variable group "Code Sign KV Auth", or
3. Remove the --timestamp-rfc3161 $(TimestampServerUrl) parameter from the AzureSignTool command in Directory.build.targets (though this is not recommended as timestamps are important for signed assemblies)