Allow all plans to use client BYOK and add org-manageable kill switch

[Copilot]

BYOK was gated to individual/internal users only. This removes the plan-type restriction and adds an InTune-manageable setting to let orgs disable BYOK.

Changes

• isBYOKEnabled(): Removed (copilotToken.isInternal || copilotToken.isIndividual) check. All plans on dotcom now qualify. GHE restriction remains.
• New setting github.copilot.chat.bringYourOwnKey.enabled: Defaults true, scope: "machine" so orgs can lock it via InTune/MDM policy. Checked early in isBYOKEnabled().
• ConfigKey.BYOKEnabled: Registered as a simple boolean config.
• BYOKContrib: Injects IConfigurationService and passes it through.

export function isBYOKEnabled(copilotToken, capiClientService, configurationService): boolean {
    if (isScenarioAutomation) return true;
    if (!configurationService.getConfig(ConfigKey.BYOKEnabled)) return false;
    return capiClientService.dotcomAPIURL === 'https://api.github.com';
}

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.