feat: network isolated cluster skip cse download

[fseldow]

What this PR does / why we need it:
feat: network isolated cluster skip cse download because network isolated cluster cannot download scripts from packages.aks.microsoft.com

Which issue(s) this PR fixes:

Fixes #

[Copilot]

Pull request overview

This PR updates the Windows provisioning flow for network-isolated clusters so the node bootstrap can skip downloading the Windows CSE scripts package (which may be unreachable) and instead use a cached scripts zip baked into the VHD.

Changes:

• Add Install-CachedScripts helper to locate and expand a cached aks-windows-cse-scripts-current.zip from the VHD cache.
• Update kuberneteswindowssetup.ps1 to skip CSE scripts download when BootstrapProfileContainerRegistryServer is set and install from cache instead.
• Add Pester unit tests covering the new cached-scripts install behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
parts/windows/windowscsehelper.ps1	Adds a new error code and introduces Install-CachedScripts to expand cached CSE scripts from the VHD cache.
parts/windows/kuberneteswindowssetup.ps1	Alters script acquisition logic to avoid downloading in network-isolated mode and use cached scripts.
parts/windows/windowscsehelper.tests.ps1	Adds unit tests validating cached scripts are expanded and proper exit behavior when missing.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 2 comments.

[Copilot]

azurecnifunc.ps1 and the other CSE function scripts are dot-sourced directly from C:\AzureData\windows after being populated from the remote CSE package URL (CSEScriptsPackageUrl) without any integrity verification. If an attacker can compromise or misconfigure the CSE package endpoint or URL, they can supply a malicious ZIP so that arbitrary PowerShell code is executed here under the node’s provisioning context. To harden this, ensure the downloaded CSE package is pinned to an immutable version and validated (e.g., via a baked-in hash or code-signing check) before expanding it into C:\AzureData\windows and dot-sourcing these scripts.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 4 comments.