Bumps [dotnet-coverage](https://github.com/microsoft/codecoverage) from 17.11.0 to 17.11.3.
- [Commits](https://github.com/microsoft/codecoverage/commits)

---
updated-dependencies:
- dependency-name: dotnet-coverage
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Enabling shallow cloning will make cloning the VS repo faster when
creating the PR.

Enable ShallowClone when performing insertion

Ensure Expand-Template uses UTF-8 when replacing placeholders.

Per @KirillOsenkov in [this comment](dotnet/sdk#36666 (comment)), SourceLink is now built into the .NET SDK.

Justification:
- Official builds will soon be _required_ to sign everything.
- Signing outside of an official build would allow bypassing all compliance checks, defeating the intent of all these checks.

Therefore: signing must happen if and only if we are running an official build, and thus we should have only one switch that controls both.

When pulling from or pushing packages to the `azure-public` account, we need to authenticate when doing so from the `devdiv` account. We were previously doing this through PAT-based service connections. With this change, we switch to WIF (Workload Identity Federation) to authenticate.

…eUpdate