[release/10.0] Enable microbuild preview plugin (backport of #16185)

[davidfowl]

Backport of #16185 to release/10.0.

Why

PR #16185 added support for the MicroBuild preview signing plugin by introducing a new enablePreviewMicrobuild parameter and refactoring the install step to call either MicroBuildSigningPlugin@4 or MicroBuildSigningPluginPreview@4 based on that flag. Without this change on release/10.0, consumers that flow Arcade from this branch (e.g. dotnet/aspire on Arcade SHA ecdd5c6a) hit the warning:

Please use latest plugin version, version 5.4.0 used instead.

Symptom seen in aspire pipeline 1602.

The original change was merged to main on 2025-10-06 and has been stable for 7+ months. It was never backported to release/10.0.

What changed

Clean cherry-pick of upstream commit ed075f46f1643382a9ff2490a985170e228db62d:

• eng/common/core-templates/job/job.yml — thread new enablePreviewMicrobuild parameter through to install-microbuild.yml and cleanup-microbuild.yml.
• eng/common/core-templates/steps/install-microbuild.yml — refactored to delegate the actual MicroBuild task invocation to a new impl template (one call for Windows, one for Mac/Linux).
• eng/common/core-templates/steps/install-microbuild-impl.yml (new) — selects MicroBuildSigningPluginPreview@4 vs MicroBuildSigningPlugin@4 based on enablePreviewMicrobuild.

No other files touched.

Validation

• Cherry-pick from main applied cleanly with auto-merge (no conflicts).
• All three YAML files parse successfully (yaml.safe_load).
• Diff against origin/release/10.0 matches the intent of Enable microbuild preview plugin #16185 (parameter plumbing + impl-template split).
• No Arcade unit tests cover these templates; YAML validity + diff review is the bar for template-only changes.

Notes

• Plugin task remains pinned to @4 per current internal guidance — no @5 bump.
• This is a structural port (not just a one-liner), keeping release/10.0 aligned with main to simplify future flow.