Enable Binskim scan in CI builds

[MilenaHristova]

Enabling BinSkim scan over build artifacts in CI based on company requirements.

We are required to run SDL tools on official builds and implement automated bug filling for the tools output. Currently we are running SDL checks over the source code in the nightly builds, inline in the builds for some of the product repos and in the .NET staging pipeline, but to be compliant we need to also run BinSkim over the produced artifacts.

This PRs is enabling BinSkim checks in the Run SDL tool job of razor-ci-official.

More information is in the Automate BinSkim runs over official builds issue

[maryamariyan]

In Razor Tooling Compliance build pipeline we also run APIScan. I think to be coherent we need this setup in that pipeline as well for compliance checks.

[MilenaHristova]

In Razor Tooling Compliance build pipeline we also run APIScan. I think to be coherent we need this setup in that pipeline as well for compliance checks.

The goal is to scan all assets that are getting shipped, so it's enough to run the tool in the official CI - that would cover all changes to the repo
cc @andriipatsula @mmitche

[mmitche]

@maryamariyan You are welcome to add the binskim to the compliance runs in https://devdiv.visualstudio.com/DevDiv/_build?definitionId=16802&_a=summary. I don't think that dnceng implemented any infra for that pipeline though. That looks to be custom for razor.

FYI it looks like that APIScan run has been failing for a while due to an authentication error.