[yuravk]

The Azure Marketplace release and the HPC image upload printed working SAS URLs into the run logs, which are public for this repository:

• azure-hpc-to-storage-container.yml pasted the base64-encoded Blob SAS URL input into the script text, which the log prints; masking only covered the decoded URL, and base64 is no protection.
• azure-to-marketplace.yml and the azure-marketplace-steps action (regular Azure releases) stored the new container SAS (read + list, 8 days) in GITHUB_ENV unmasked, so every later step listed it, and the configure step pasted it into its script text.
• Both also dumped the product resource tree, technical configuration and configure payload, which carry the SAS URI of every VM image version already in the offer.

Now:

• The HPC upload reads the input from the event payload and masks the encoded URL, the decoded URL and its signature (as is and URL-decoded) before anything else. It also fails early, without printing the value, when the decoded input is not a Blob SAS URL.
• The release masks the storage account key, the new SAS token and its signature right after creating them, and reads SAS_URI from the environment instead of an expression.
• Right after fetching the resource tree, the release masks the signature of every SAS URI in it, which covers all the later dumps.

Also correct the stale "60 days" SAS expiry comment (it is 8 days) and document the masking.