Add dedicated anti-malware validation job

[quasarea]

What changed

• adds the Architecture anti-malware template repository reference
• runs Defender-backed anti-malware scanning in a dedicated Windows job
• keeps the Windows Black Duck scan as a separate downstream job

Validation

• yamllint passed for azure-pipelines.yml
• no VS Code file errors reported

[quasarea]

Superseded by PR #20 after moving the anti-malware change onto the original branch.