release: enable TSA and remove our baselines file (#32664)

There are two ways to handle policy (binskim, policheck, etc.) failure: put them in one giant JSON file full of hashes, or let an internal process called "TSA" turn them into bugs.

This moves us to the latter.

.github/actions/spell-check/expect.txt

@@ -1614,6 +1614,7 @@ triaging
 TRK
 trl
 trx
+tsa
 Tsd
 TServer
 TStr

.pipelines/release.yml

@@ -33,6 +33,10 @@ extends:
       name: SHINE-INT-S
       image: SHINE-VS17-Latest
       os: windows
+    sdl:
+      tsa:
+        enabled: true
+        configFile: '$(Build.SourcesDirectory)\.pipelines\tsa.json'
 
     stages:
     - stage: build
@@ -55,9 +59,6 @@ extends:
           - output: pipelineArtifact
             artifactName: setup-$(BuildPlatform)
             targetPath: $(Build.ArtifactStagingDirectory)
-          sdl:
-            baseline:
-              baselineFile: $(Build.SourcesDirectory)\.pipelines\sdl.gdnbaselines
         displayName: Build
         timeoutInMinutes: 240 # Some of the 1ES Pipeline stuff and Loc take a very long time
         cancelTimeoutInMinutes: 1

.pipelines/tsa.json

@@ -0,0 +1,7 @@
+{
+    "codebaseName": "PowerToys_main",
+    "notificationAliases": ["powertoys@microsoft.com"],
+    "instanceUrl": "https://microsoft.visualstudio.com",
+    "projectName": "OS",
+    "areaPath": "OS\\Windows Client and Services\\ADEPT\\E4D-Engineered for Developers\\SHINE\\PowerToys"
+}