Migrate CreateBaselineUpdatePR to Microsoft.DotNet.Baselines.Tasks as MSBuild Task

[ellahathaway]

This PR migrates the CreateBaselineUpdatePR tool from the VMR to a new Arcade project, Microsoft.DotNet.Baselines.Tasks. It also refactors the tool from a command-line utility to a custom MSBuild task.

The main advantage of this change is that it enables binlog generation when the task is invoked via the sdk-tasks script or included in a project (see dotnet/source-build#5055). Additionally, moving the tool out of the VMR broadens its usability, making it possible to leverage this tooling outside the VMR context. For example, it could be used to update repo-specific exclusions files during official repo-level builds—such as sign check exclusions, if SignCheck adds support for updating exclusions baselines.

Note that I do not want to remove the original VMR tooling yet. That will have to be done after a rebootstrap that includes these changes.

[ViktorHofer]

Does this need to be in-built functionality inside the Arcade SDK or would it be sufficient to just use the package reference in consuming repos and get all the functionality via that?

[ellahathaway]

Does this need to be in-built functionality inside the Arcade SDK or would it be sufficient to just use the package reference in consuming repos and get all the functionality via that?

Some scenarios can use a package reference in consuming repos, but others require running the task as a pipeline step. That’s why I added it to the Arcade SDK—so it can be easily invoked by the sdk-tasks scripts in a pipeline.

For example, in the license scanner pipeline, publishing the baselines PR has to happen in the pipeline, and cannot be integrated into the test's project file. This is because multiple license scanner jobs run in parallel, and their test results are merged to produce the updated baselines.

In my opinion, putting this functionality in the Arcade SDK so that it can be invoked via sdk-tasks is the most scalable way to support these pipeline requirements.

[ViktorHofer]

Should this link be configurable? The default is fine but I wonder whether this should be overridable.

[ellahathaway]

The tool is currently only used in internal dnceng builds, so I think the default is fine as-is. We can always make it configurable later if needed.