[PM-40492] Regenerate NuGet lock files during version bump

[Hinton]

https://bitwarden.atlassian.net/browse/PM-40492

Summary

• packages.lock.json files pin internal ProjectReference versions (e.g. "Core": "[2026.7.2, )"), so bumping Directory.Build.props's Version left every lock file stale until an unrelated PR happened to restore packages and picked up the churn as unrelated diff noise (e.g. [PM-41079] Extract SSRF protection into src/Libraries/SsrfProtection #8066 carried ~20 incidental 2026.7.1 → 2026.7.2 lock-file line changes).
• Adds a dotnet restore bitwarden-server.slnx --force-evaluate step to the bump_version job right after the version bump, so refreshed lock files land in the same commit/PR as the version bump itself.

Test plan

• Verified locally: bumping Directory.Build.props's Version and running dotnet restore --force-evaluate regenerates the internal ProjectReference version pins in packages.lock.json.
• Verified the restore is a no-op (no diff) when the version hasn't changed.
• Confirm the workflow runs successfully end-to-end via workflow_dispatch on a test run.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.69%. Comparing base (ab12fbd) to head (75f3251).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8097   +/-   ##
=======================================
  Coverage   62.68%   62.69%           
=======================================
  Files        2296     2296           
  Lines      100051   100051           
  Branches     9004     9004           
=======================================
+ Hits        62721    62722    +1     
+ Misses      35147    35146    -1     
  Partials     2183     2183           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR adds a Set up .NET step and a dotnet restore bitwarden-server.slnx --force-evaluate step to the bump_version job in .github/workflows/repository-management.yml, so packages.lock.json internal ProjectReference pins are refreshed in the same commit as the Directory.Build.props version bump. I verified that every project carrying a packages.lock.json is included in bitwarden-server.slnx (so no lock file is left stale), that AppHost intentionally opts out via RestorePackagesWithLockFile=false (so restore will not create an untracked lock file), and that the new setup-dotnet pin and no-input/global.json pattern matches build.yml, test.yml, and test-database.yml. Restore artifacts (obj/) are gitignored and git commit -a only stages tracked changes, and all PackageReference versions use exact [x.y.z] pins, so --force-evaluate should not introduce unrelated dependency drift into the bump PR.

Code Review Details

No findings.