Condition out DefaultAzureCredential in release builds (#1775)

Author: lbussell

src/Microsoft.DotNet.ImageBuilder/src/AzureTokenCredentialProvider.cs

@@ -63,8 +63,20 @@ Attempted to get Service Connection credential but SYSTEM_ACCESSTOKEN environmen
                         _systemAccessToken);
                 }
 
+#if DEBUG
                 // Fall back to DefaultAzureCredential if no service connection is provided.
+                // This can still be used for local development against non-production resources.
                 credential ??= new DefaultAzureCredential();
+#endif
+
+                if (credential is null)
+                {
+                    // Using DefaultAzureCredential is not allowed in production environments.
+                    throw new InvalidOperationException(
+                        "Attempted to get an Azure Pipelines Credential but no service connection was provided."
+                    );
+                }
+
                 var accessToken = credential.GetToken(new TokenRequestContext([scope]), CancellationToken.None);
                 return new StaticTokenCredential(accessToken);
             });