cherry-pick(#2036): devops: add explicit checkout steps to pipelines

Author: yury-s

.azure-pipelines/publish-docker.yml

@@ -47,6 +47,7 @@ extends:
         timeoutInMinutes: 360
         steps:
         - checkout: self
+          persistCredentials: false
           displayName: "Checkout code"
 
         - task: UseNode@1

.azure-pipelines/publish.yml

@@ -36,6 +36,10 @@ extends:
             path: $(Build.ArtifactStagingDirectory)/esrp-build
             artifact: esrp-build
         steps:
+        - checkout: self
+          persistCredentials: false
+          displayName: "Checkout code"
+
         - bash: |
             if [[ ! "$CURRENT_BRANCH" =~ ^v1\..* ]]; then
               echo "Can only publish from a release tag branch (v1.*)."