fix(safeoutputs): resolve FileContainer service URL via resource areas to fix 405 on upload-pipeline-artifact

[Copilot]

Summary

upload-pipeline-artifact was failing with HTTP 405 on the container creation step because POST /_apis/resources/containers is served by ADO's FileContainer/distributedtask service (vstmr.dev.azure.com/{org}), not the main org URL (dev.azure.com/{org}). Hardcoding org_url as the base hit the wrong routing proxy, which has no POST handler for that path.

Fix: Before Steps 1 & 2 (container create + file upload), the executor now resolves the correct service base URL via the resource areas API — the same mechanism the azure-devops-node-api uses internally:

GET {org_url}/_apis/resourceAreas/e4f45d1e-c5e5-4112-a594-9d59a8f6c707?api-version=7.1
→ { "locationUrl": "https://vstmr.dev.azure.com/{org}/" }

• All _apis/resources/containers calls (Steps 1 & 2) use the resolved locationUrl
• Step 3 (_apis/build/builds/{id}/artifacts) is unaffected — it routes correctly via the main org URL
• Graceful fallback to org_url if the resource area lookup fails (on-premises ADO Server compatibility)

Test plan

• Existing 20 unit tests pass unchanged
• New test_resolve_file_container_base_url_falls_back_on_error test verifies the fallback path (connection refused → returns original org_url)