[Veeam] Revert CCF public-preview connector (PR #14462); add NuGet packageSourceMapping; bump 3.1.1

Solutions/Veeam/Data Connectors/AzureFunctionVeeam/NuGet.Config

@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  SECURITY: NuGet Package Source Mapping (NuGet 6.0+)
+
+  Mitigates dependency-confusion / supply-chain attacks for private Veeam SDK packages.
+
+  The packages below are NOT available on nuget.org:
+    - Veeam.AC.VBR.ApiClient  (Veeam Backup & Replication API client SDK)
+    - 00000000-94D5-4BF9-8A50-7BD9929A0850  (internal Veeam SDK package)
+
+  Without source mapping NuGet could silently fall back to nuget.org for these
+  packages, allowing an attacker who registers either name on the public registry
+  to inject a malicious build-time payload.
+
+  How the mapping works:
+    - "Veeam.*" and "00000000-*" are bound EXCLUSIVELY to the private "veeam-private"
+      feed. Because these are more specific than the "*" pattern, NuGet uses them and
+      NEVER looks for those packages on nuget.org (most-specific pattern wins).
+    - "*" -> nuget.org lets every other public/transitive package (e.g. Newtonsoft.Json,
+      System.*) restore normally. Without this catch-all, restore fails on a clean/CI
+      cache with NU1100 for any unmapped package.
+
+  BUILD CONFIGURATION:
+  The private feed URL is intentionally NOT committed. Supply it per environment:
+    a) Set the environment variable VEEAM_NUGET_FEED to the feed URL (expanded below).
+    b) Or add the source via the NuGet CLI:
+         nuget sources add -Name veeam-private -Source <feed-url>
+    c) Or configure it in the CI/CD pipeline's NuGet configuration / Service Connection.
+  Do NOT commit feed credentials to this file.
+-->
+<configuration>
+  <packageSources>
+    <clear />
+    <!-- Public feed -->
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
+    <!-- Veeam private feed - supplied via VEEAM_NUGET_FEED per environment (see header) -->
+    <add key="veeam-private" value="%VEEAM_NUGET_FEED%" protocolVersion="3" />
+  </packageSources>
+  <packageSourceMapping>
+    <!-- Everything public resolves from nuget.org (overridden by the more specific patterns below) -->
+    <packageSource key="nuget.org">
+      <package pattern="*" />
+    </packageSource>
+    <!-- Private Veeam SDK packages - bound exclusively to the private feed, never nuget.org -->
+    <packageSource key="veeam-private">
+      <package pattern="Veeam.*" />
+      <package pattern="00000000-*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>

Solutions/Veeam/Data Connectors/AzureFunctionVeeam/Veeam.Sentinel.FunctionApp/Veeam.Sentinel.FunctionApp.csproj

@@ -8,7 +8,7 @@
 	</PropertyGroup>
 	<ItemGroup>
 		<FrameworkReference Include="Microsoft.AspNetCore.App" />
-		<PackageReference Include="00000000-94D5-4BF9-8A50-7BD9929A0850" Version="12.1.0.364" />
+		<PackageReference Include="00000000-94D5-4BF9-8A50-7BD9929A0850" Version="[12.1.0.364]" />
 		<PackageReference Include="Azure.Monitor.Ingestion" Version="1.1.2" />
 		<PackageReference Include="Azure.Monitor.Query" Version="1.6.0" />
 		<PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.7.0" />
@@ -19,7 +19,7 @@
 		<PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http.AspNetCore" Version="1.3.2" />
 		<PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Storage.Blobs" Version="6.7.0" />
 		<PackageReference Include="Microsoft.Azure.Functions.Worker.Sdk" Version="1.18.1" />
-		<PackageReference Include="Veeam.AC.VBR.ApiClient" Version="8.1.0.69" />
+		<PackageReference Include="Veeam.AC.VBR.ApiClient" Version="[8.1.0.69]" />
 		<ProjectReference Include="..\VoneApiClient\VoneApiClient.csproj" />
 		<ProjectReference Include="..\CovewareApiClient\CovewareApiClient.csproj" />