Route NuGet restores through CFS

[fabiocav]

Summary

• replace the direct NuGet.org source with the public Central Feed Service endpoint and wildcard package source mapping
• make both Azure Pipelines restore tasks consume the repository nuget.config
• make GitHub Actions and the performance-test container perform one explicit configured restore, then build/publish without restoring again

Validation

• restored all 7 projects from an empty, isolated NuGet global-packages, HTTP, plugin, scratch, and CLI-home cache under .NET SDK 8.0.423
• exercised the detached checkout from a path containing spaces with PowerShell argument arrays; 256 package IDs restored across 1,396 observable CFS request lines with no direct NuGet.org/npmjs/PyPI traffic
• built the solution in Release, passed 30 non-database tests, packed all 3 shipping projects, and published the performance-test app without another restore
• audited all 3 .nupkg files and 78 publish-output files: no feed config, credential-like file, lockfile, or node_modules content was shipped
• ran the transitive vulnerability listing through the repository CFS config; existing advisories remain visible and were not suppressed

Caveat

The local Docker daemon was unavailable. The Docker restore/publish commands were exercised directly; the repository's existing sdk:6.0 builder image also predates the performance project's net8.0 target and is outside this feed-routing change.