Context

As part of #11981, we have identified security hot spots in the VMR synchronization process and proposed what to do about them.

The last step is incorporating the darc vmr push command introduced as part of #12082 into the official installer CI pipeline that synchronizes the VMR.

Goals

• Create PAT that we use for the commit verification and store it in some KeyVault. Set up the secret manager (in arcade probably) to watch over this secret.
• Wire up the command with the PAT and the pipeline so that public branch pushes are verified and internal ones are not.

Test scenarious

• Pushing to a public branch where all commits are available publicly - should be successful
• Pushing to a public branch with a commit that is not available publicly - should not be executed
• Pushing to a internal branch - should be executed without querying for commits