MDE in passive mode prevents windows build agents from being in compliance with security requirements

[rem-aj]

Hi all,

While working on compliance to secure our build agents, we noticed this PR for the image puts MDE in passive mode to prevent scanning during image creation - #4415 looks like it was related to this issue - #4277

Is it possible for us to turn it back to active mode after image creation is completed as final step? This will allow our build agents to be compliance with security requirements.

Thanks!

[grgrandbois]

Maybe we can parameterize this feature? So consumers can elect whether or not they want to enable active mode as the last step?