(Reasonably) secure Azure Pipelines on-prem deployments