Add file transform security note and troubleshooting for blocked xdt:Import

[Nemanja Rogic (nemanjarogic)]

Summary

File transformations run by the File Transform and Azure App Service / Web App / Function App deployment tasks now process only the built-in XDT transform and locator types. The xdt:Import element (which loads a custom transform assembly by name or path) and any custom xdt:Transform / xdt:Locator types are rejected by default, because a transform file that comes from an untrusted package could otherwise load and run arbitrary code on the pipeline agent.

Changes described above are made through: microsoft/azure-pipelines-tasks-common-packages#641

This PR documents that secure-by-default behavior, the recommended alternatives, and the opt-out variable.

Changes

• docs/pipelines/targets/includes/webapp/deploy-options.md — added an [!IMPORTANT] note beside the File Transform task reference: file transformations allow only built-in XDT types; how to adapt (use built-ins, or pre-apply custom transforms before the package reaches the pipeline); and the AZP_ALLOW_UNSAFE_XDT_TRANSFORMS opt-out (flagged as not recommended). This is a shared include, so the note surfaces on the Azure Web App / App Service deployment target pages.
• docs/pipelines/troubleshooting/troubleshoot-azure-web-app-deploy.md — added a new troubleshooting section, "XML transformation or variable substitution fails after a file transform security update" (Symptom / Cause / Resolution), for customers whose custom XDT transforms stop working; updated ms.date.

Why

Secure-by-default: untrusted transform content should not be able to execute code on the agent. The opt-out is documented so pipeline authors with a legitimate need can consciously — and temporarily — restore the previous behavior, with the risk called out.

[prmerger-automator]

Nemanja Rogic (@nemanjarogic) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change.

[prmerger-automator]

Nemanja Rogic (@nemanjarogic) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change.

[Regan Downer (v-regandowner)]

chcomley (@chcomley)

Can you review the proposed changes?

IMPORTANT: When the changes are ready for publication, adding a #sign-off comment is the best way to signal that the PR is ready for the review team to merge.

#label:"aq-pr-triaged"
@MicrosoftDocs/public-repo-pr-review-team

[Diana Richards (v-dirichards)]

Nemanja Rogic (@nemanjarogic) chcomley (@chcomley) Can you take this PR out of review please? We cannot merge while it's in draft mode. Thanks.