Fix axios supply chain vulnerability in CI scripts (#5524)

* Fix axios supply chain vulnerability in CI scripts

    Pin axios to exact versions and add --ignore-scripts to prevent
    postinstall script execution in CI pipelines.

    Ref: #5517

* Added npm ci and private feed

Author: sanjuyadav24

.azure-pipelines/pipeline.yml

@@ -129,9 +129,12 @@ extends:
           timeoutInMinutes: 300
           steps:
           - template: /.azure-pipelines/get-pat.yml@self
+          - task: NpmAuthenticate@0
+            inputs:
+              workingFile: .azure-pipelines/scripts/.npmrc
           - bash: |
               cd ./.azure-pipelines/scripts/
-              npm install axios minimist
+              npm ci --ignore-scripts
 
               releaseBranch="${{ parameters.branch }}"
               sourceBranch="$(Build.SourceBranch)"

.azure-pipelines/scripts/.npmrc

@@ -0,0 +1,3 @@
+registry=https://pkgs.dev.azure.com/mseng/PipelineTools/_packaging/PipelineTools_PublicPackages/npm/registry/
+
+always-auth=true

.azure-pipelines/scripts/package-lock.json

@@ -0,0 +1,10 @@
+{
+  "name": "azure-pipelines-canary-scripts",
+  "version": "1.0.0",
+  "private": true,
+  "description": "CI scripts for Azure Pipelines Agent canary tests",
+  "dependencies": {
+    "axios": "1.14.0",
+    "minimist": "1.2.8"
+  }
+}