Add support for component goverance into the pipeline

[gilbertw]

Ensure we are properly scanning the source and dependencies.

[damirault]

Component Governance team is investigating adding support for VCPkg.

[danieljurek]

At the moment there is not an out-of-box pluggable solution for this. There are a couple of approaches which require custom work.

[kurtzeborn]

Component Governance runs everywhere now.