Fix NoScript guards: respect tenant property-bag override, exempt SPFx custom actions (#1224)

[nicolaor]

Fixes #1224

Problem

PnP Framework's NoScript site guards currently block all property bag writes and all custom action updates on sites with DenyAddAndCustomizePages = Enabled. This is too aggressive in two scenarios:

1. Property bag writes — SharePoint supports a tenant-level setting AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled that re-enables property bag operations on NoScript sites. The framework ignores this flag entirely, causing provisioning to silently skip property bag entries, reindex operations, and theme metadata even when the tenant explicitly allows them.

2. SPFx custom actions — SharePoint permits SPFx extensions (custom actions with a ClientSideComponentId) on NoScript sites, but the framework blanket-blocks all custom action add/update operations, preventing SPFx provisioning from working.

Solution

Property bag: probe-and-delegate

Since the tenant flag isn't exposed via any site-level API, the framework now uses a sentinel write probe: on NoScript sites, it attempts a temporary property bag write to detect whether the tenant override is active. If the write succeeds, the sentinel key is cleaned up and property bag operations proceed normally. If it fails, writes remain blocked (safe-by-default).

To avoid the extra round-trips of the probe, callers who already know the tenant flag value can set PropertyBagWriteAllowed on ProvisioningTemplateApplyingInformation:

• true — property bag writes proceed, no probe
• false — property bag writes are skipped, no probe
• null (default) — auto-detect via sentinel probe

The same opt-in parameter is also available on the standalone ReIndexWeb() and SetThemeByUrl() extension methods.

Within the provisioning pipeline, the flag is resolved once at the start and shared across all handlers, so the probe cost is paid at most once per provisioning run.

Custom actions: per-action SPFx exemption

Instead of blanket-blocking all custom action operations on NoScript sites, the framework now checks each action individually. Actions with a non-empty ClientSideComponentId are recognized as SPFx extensions and exempted from the NoScript guard. Classic (non-SPFx) custom actions remain blocked as before.

Backward compatibility

Note

All new parameters are optional with null defaults — existing callers are unaffected. The default auto-detect behavior is safe-by-default: if the sentinel probe fails for any reason (permissions, connectivity, etc.), property bag writes remain blocked, preserving pre-existing behavior.