Clear position on resilience of SaaS engineering tooling

[andyblundell]

For example, if using a SaaS tool for static-code analysis, it's unlikely to be ok for an outage on that SaaS product to break your pipelines such that you can't update your product.

Clearly there are options here, including:

1. Simple & documented process to disable certain pipeline steps so that the SaaS outage in question can be worked around
2. Running a self-hosted equivalent of that SaaS product as a backup

... and what makes sense will clearly depend on the impact of any outage, the criticality of that SaaS tool, the SLA of the service, etc, etc.

[andyblundell]

Should probably be referenced in the resilience section, the outsource-from-the-bottom-up section, and the CI section