1ESPT conversion cleanup

[chcosta]

• As part of cleanup from 1ES PT conversion, we should examine whether the CodeQL template we provide is still necessary or we can just direct to the 1ES path.

  Add official copy of the Arcade templates that is compatible with 1ES… #14525 (comment)

• Consider removing SDLValidationParameters - https://github.com/dotnet/arcade/pull/14525/files#r1508020331

• Validate whether setup-maestro-vars.yml is any use. I think its usefulness died with the addition of --default-channels in add-build-to-channel

[riarenas]

Adding a few more items

• Clean up any conditional that mentions running a PR, running as public, or running in the public project

• Understand whether we still need to generate SBOMs with our own templates or can solely rely on the template injected sbom generation. This might not be possible, as the Microbuild guidance is to keep using the manifest generator task...

  SBOM: The Migration Tooling will remove the SBOM Manifest Builder Task. Please put this back. The SBOM tasks in the 1ES PT does not conform to the way that we package up SBOM's into manifest files in MicroBuild.

[dougbu]

re the CodeQL point: parameters.PackageVersion is a lousy name anyhow. we should at least fix that if the hook is still needed

[akoeplinger]

Understand whether we still need to generate SBOMs with our own templates or can solely rely on the template injected sbom generation. This might not be possible, as the Microbuild guidance is to keep using the manifest generator task...

if we keep our own SBOM task then we need to bump the package version since it wasn't bumped in main: #14511

[riarenas]

As a more general cleanup point:

• the public templates should only do public things
• the official templates should only do official things

[riarenas]

Understand whether we still need to generate SBOMs with our own templates or can solely rely on the template injected sbom generation. This might not be possible, as the Microbuild guidance is to keep using the manifest generator task...

if we keep our own SBOM task then we need to bump the package version since it wasn't bumped in main: #14511

Especially because a certain @riarenas said we shouldn't update it in main yet😛