Ensure devtunnel access policies are correct when updating tunnel

[DamianEdwards]

Description

Ensures that when dev tunnel resources are starting, if the underlying dev tunnel in the sky already exists, its access policies are reset to match the options specified in the application model, i.e. whether anonymous access is enabled or not.

Fixes #11833

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
• Are you including unit tests for the changes and scenario tests if relevant?
  • No
• Did you add public API?
  • No
• Does the change make any security assumptions or guarantees?
  • No
• Does the change require an update in our Aspire docs?
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 12291

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 12291"

[Copilot]

Pull Request Overview

This PR ensures that dev tunnel access policies are correctly applied when updating existing tunnels. When a dev tunnel resource starts and the underlying tunnel already exists, the code now resets the access policies to match the application model configuration, specifically whether anonymous access is enabled.

Key changes:

• Adds logic to reset existing access policies when updating a tunnel
• Conditionally sets anonymous access based on the AllowAnonymous option
• Adds trace logging for access policy operations