TriggerBuild V4: attribute triggered build to the original user via impersonation (ADO Server 2022.1+/2025)

[eliorceva]

Since Azure DevOps Server 2022.1 Patch 1 (and 2025), the server ignores the
requestedFor field when queuing a build (security hardening), so "Queue Build
for user that triggered original build" no longer works — the triggered build is
always attributed to the authenticating identity. Fixes #263.

This restores it using the supported server-side impersonation mechanism:

• Resolves the triggering user's legacy IdentityDescriptor from
  BUILD_REQUESTEDFORID / RELEASE_REQUESTEDFORID via the Identities API.
• Sends it in the X-TFS-Impersonate header, scoped to the queue call only
  (condition checks / waiting stay as the authenticating identity).
• Requires the authenticating identity to hold the collection permission
  "Make requests on behalf of others".

Safe fallback: if the descriptor can't be resolved or impersonation isn't
available (e.g. Azure DevOps Services), it logs a warning and falls back to the
previous behaviour — no hard failure.

Adds unit tests for descriptor resolution, header injection scoped to the queue
call, and the fallback path. Verified live on Azure DevOps Server 2025.

[huserben]

Hi @eliorceva

Thanks for your PR, however, I'm not actively maintaining the task anymore. So while I could merge it, properly testing it would take time I don't have (apart from the fact that I'm not using an ADO environment anymore which complicates it even more), and I will not publish it untested.

There may be forks of this tasks or other tasks that achieve the same thing already. My proposal is that you check those out, or, if you want, create your own fork and use this one.