Add PoliCheck banned-words validation for PR titles and descriptions

[Galina Paskaleva (gpaskaleva-msft)]

Summary

Adds a validation stage to the PR pipeline that scans each pull request's title and description for words that should not be shared publicly. On a match, it posts a comment on the PR and fails the check.

An equivalent check was enforced before mainline development moved to GitHub; this restores that protection so PR titles and descriptions are guarded again.

Fixes #11730

What this introduces

A new ValidatePrContent stage in build/WinUI-GitHub-PR.yml that runs on every PR:

• Reads the PR title + description via the public GitHub API.
• Scans them against a configured word list.
• On a match: comments on the PR (indicating the offending word) and fails the check.
• Skips automated bot PRs (e.g. dotnet-maestro[bot]).
• Idempotent commenting — no duplicate comments on re-runs.

Approach

• The word list is stored as a secret and fetched at runtime, so it is masked in logs and never exposed in pipeline output.
• The check is self-contained: if its configuration is missing, only this stage fails — it does not block the rest of the build.
• Reuses existing pipeline credentials — no new tokens are introduced.

Notes

• Enabling this check requires one-time pipeline configuration (secret + authorization), tracked separately from this PR.
• Until that configuration is in place, this stage will report as failing; the failure is isolated to this stage.

Testing

• Validated with a throwaway PR containing a flagged word in the title/description.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Galina Paskaleva (gpaskaleva-msft)]

/azp run

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.

[Galina Paskaleva (gpaskaleva-msft)]

/azp run

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.

[Harshit (harshit7962)]

Re-queuing the build as a few extra service connections have been now disabled.

[Harshit (harshit7962)]

/azp run

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.

[Harshit (harshit7962)]

Still reviewing, posting single finding as of now

[Harshit (harshit7962)]

do we need to mention service connection explicitly? Also, this is not the service connection we use. Please check this again, ideally service connection should not be mentioned explicitly. Why is this needed? Also, if I am not wrong, this service connection was recently introduced, so why is it needed now?