Switch ESRP service connection to wif2 to fix npm publish (#672)

The TypeScript build-and-publish pipeline fails in the EsrpRelease task
while acquiring a token:

  AADSTS700213: No matching federated identity record found for
  presented assertion subject

The 'Devtunnels-esrp-ame-msi' service connection's federated identity
credential no longer matches the assertion subject presented by the
ADO v5 agent, so the release gateway is never reached and no package is
published.

dev-tunnels-ssh hit the same failure and resolved it by moving to the
'Devtunnels-esrp-ame-msi-wif2' connection in
microsoft/dev-tunnels-ssh@d8a9ff1. This applies the equivalent change
here; everything else about the ESRP configuration (tenant, client id,
key vault, signing certificate, task version) is unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: DavidObando

.pipelines/typescript-build-and-publish.yaml

@@ -17,15 +17,21 @@ variables:
 
   # ESRP Code Signing
   # ESRP Registration: https://portal.esrp.microsoft.com/Onboarding/AccountDetails?clientId=142047f4-eda8-4853-8776-c2e81803ea13
-  # Service connection in devdiv Azure DevOps: Devtunnels-esrp-ame-msi (https://devdiv.visualstudio.com/OnlineServices/_settings/adminservices?resourceId=702454c9-77bd-4750-820e-5ce2e483f9f5)
+  # Service connection in devdiv Azure DevOps: Devtunnels-esrp-ame-msi-wif2
+  # (listed under https://devdiv.visualstudio.com/OnlineServices/_settings/adminservices)
+  # This replaces the earlier 'Devtunnels-esrp-ame-msi' connection (resourceId 702454c9-77bd-4750-820e-5ce2e483f9f5).
+  # That connection's federated identity credential no longer matches the assertion subject presented by the
+  # ADO v5 agent, so EsrpRelease fails to acquire a token with 'AADSTS700213: No matching federated identity
+  # record found for presented assertion subject'. dev-tunnels-ssh made the same switch in
+  # microsoft/dev-tunnels-ssh@d8a9ff1.
   # Managed identity that this service connection has federated access to: tunnels-ppe-esrp-id (client id 01ee3ff5-3b24-4b62-996e-6217f7cf3487) in AME tenant (33e01921-4d64-4f8c-a055-5bdaffd5e33d).
   # Signing certificate: esrp-sign in tunnels-ppe-esrp-kv
   # ESRP used to use a cert to authenticate as app in Microsoft tenant, but now it uses a managed identity in AME tenant.
   # The migration was done following these TSGs:
   # https://eng.ms/docs/microsoft-security/identity/trust-and-security-services/tss-high-security-environments/tss-esrp-fabric-and-platform-services/esrp-documentation/tsgs/sfi/tsg501-eliminate-access-to-codesigning-from-corp-tenants
   # https://eng.ms/docs/microsoft-security/identity/trust-and-security-services/tss-high-security-environments/tss-esrp-fabric-and-platform-services/esrp-documentation/tsgs/sfi/tsg506-integrating-esrp-release-ado-extension
 
-  EsrpConnectedServiceName: 'Devtunnels-esrp-ame-msi' # Service connection with ESRP MSI based authentication
+  EsrpConnectedServiceName: 'Devtunnels-esrp-ame-msi-wif2' # Service connection with ESRP MSI based authentication
   EsrpClientId: '142047f4-eda8-4853-8776-c2e81803ea13' # ESRP Client Id, the Old App Registration Id to which we mapped our Managed Identity Id to
   EsrpAuthAKVName: 'tunnels-ppe-esrp-kv' # Key Vault name where the signing certificate is stored
   EsrpAuthSignCertName: 'esrp-sign' # Code signing certificate name in the Key Vault