Add renewable Entra authentication for Helix pipelines

[missymessa]

Summary

• add opt-in renewable Entra/WIF authentication for runtime-specific Helix submission paths
• centralize standalone Helix monitoring so runtime pipelines preserve their existing 540- and 720-minute limits
• cover runtime tests, libraries, cDAC, SuperPMI, installer, and crossgen2 submission paths while keeping PAT/anonymous behavior as the default

Validation

• Private build 3084900 kept the Release JobMonitor inside AzureCLI@2 for 75 minutes and succeeded after 10 WIF-backed Azure CLI logins from 03:35Z through 04:47Z, with no AADSTS700024, HTTP 401, or TF401444 failures.
• Private build 3084797 continuously polled Azure DevOps and staging Helix for 115 minutes: 230 Azure DevOps requests and 459 Helix/storage requests completed with zero retries or failed attempts. The build itself timed out because the staging queue had no active workers, not because authentication expired.
• Azure DevOps server preview expanded the clean branch successfully with 54 library submissions, preserved runtime path-filter expressions, and no Azure CLI tasks while the opt-in remains disabled.
• All changed YAML and MSBuild XML files parse successfully.

Dependency

This PR is intentionally a draft until dotnet/arcade#17592 merges and its official Arcade dependency update brings the new useEntraAuthentication and azureSubscription parameters into generated eng/common templates. The runtime opt-in defaults to false, so existing PAT/anonymous behavior remains unchanged before that flow.

Tracking: AB#12269

This pull request was prepared with GitHub Copilot. The implementation and validation evidence were reviewed before publication.

[azure-pipelines]

Azure Pipelines:
Successfully started running 7 pipeline(s).
9 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/runtime-infrastructure
See info in area-owners.md if you want to be subscribed.