New policies to restrict personal access token scope and lifespan

Introduced new policies for Azure DevOps administrators to restrict Personal Access Token (PAT) creation. These policies allow administrators to: 1. Restrict the creation of global PATs (tokens valid across all accessible Azure DevOps organizations). 2. Restrict the creation of full-scoped PATs. 3. Define a maximum lifespan for newly created PATs. These policies apply to new PATs created for Azure DevOps organizations linked to an Azure AD tenant. Allowlists can be configured for users and groups who are exempt from policy management but cannot configure policies. Existing PATs are unaffected but must be updated to comply before renewal.