fix: enforce packageSourceMapping and prevent credentials in build cache

Root causes of the 401 failures:
- Approach 1 (--configfile): the CI script wrote the literal string
  \ into the XML file instead of the actual PAT
  value (shell variable not expanded), so NuGet forwarded that literal
  string to Azure DevOps  401.  Also --configfile replaces all
  config-file lookup, silently dropping packageSourceMapping.
- Approach 2 (config layering): credentials were copied to
  ~/.nuget/config/credentials.config, a path the .NET NuGet client
  never scans. On Linux the user-level config is
  ~/.nuget/NuGet/NuGet.Config (single file). The credentials file was
  ignored entirely  401.

Current approach (dotnet nuget update source) is correct; two fixes:

1. Prevent credentials from leaking into the Docker build-layer cache.
   dotnet nuget update source writes the PAT into /src/nuget.config.
   With cache-to: type=gha,mode=max that modified file is cached.
   Fix: back up nuget.config before injection and restore it at the end
   of the same RUN command so the committed layer contains only the
   original credential-free file.  The PAT itself never leaves the
   BuildKit secret mount.

2. Enforce packageSourceMapping.  Per NuGet docs, packageSourceMapping
   is bypassed when the MSBuild RestoreSources property is set.
   Removing RestoreSources from Directory.Packages.props lets
   nuget.config (with its packageSourceMapping) be the single source of
   truth:
   - ContentFeedNuget  private Azure DevOps feed only (no nuget.org
     package with that name can be injected via dependency confusion)
   - *  nuget.org (including EssentialCSharp.Shared.Models, which is
     a public package; confirmed by PR builds succeeding without private
     feed credentials)
   The AccessToNugetFeed condition on the ContentFeedNuget PackageVersion
   and PackageReference ItemGroups continues to control whether the
   private-feed package is part of the build.

Author: BenjaminMichaelis

Directory.Packages.props

@@ -4,13 +4,6 @@
     <CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
     <ToolingPackagesVersion>1.1.1.19025</ToolingPackagesVersion>
     <AccessToNugetFeed Condition="'$(AccessToNugetFeed)' == ''">false</AccessToNugetFeed>
-    <RestoreSources>
-      https://api.nuget.org/v3/index.json;
-    </RestoreSources>
-    <RestoreSources Condition="$(AccessToNugetFeed)">
-      $(RestoreSources);
-      https://pkgs.dev.azure.com/intelliTect/_packaging/EssentialCSharp/nuget/v3/index.json;
-    </RestoreSources>
   </PropertyGroup>
   <PropertyGroup>
     <SemanticKernelVersion>1.72.0</SemanticKernelVersion>

EssentialCSharp.Web/Dockerfile

@@ -1,4 +1,4 @@
-#syntax=docker/dockerfile:1.2
+# syntax=docker/dockerfile:1.4
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled AS base
 WORKDIR /app
@@ -19,6 +19,7 @@ WORKDIR /src
 COPY . .
 COPY --from=frontend-build /frontend/EssentialCSharp.Web/wwwroot/dist ./EssentialCSharp.Web/wwwroot/dist
 RUN --mount=type=secret,id=nuget_pat,required=false \
+    cp nuget.config nuget.config.bak && \
     if [ "$ACCESS_TO_NUGET_FEED" = "true" ] && [ -f /run/secrets/nuget_pat ]; then \
       dotnet nuget update source EssentialCSharp \
         --username az \
@@ -27,7 +28,8 @@ RUN --mount=type=secret,id=nuget_pat,required=false \
     fi && \
     dotnet restore "EssentialCSharp.Web.slnx" -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED && \
     dotnet build "EssentialCSharp.Web.slnx" -c Release --no-restore -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED -p:ReleaseDateAttribute=True -p:SkipFrontendBuild=true && \
-    dotnet publish "EssentialCSharp.Web.slnx" -c Release -p:PublishDir=/app/publish -p:UseAppHost=false -p:SkipFrontendBuild=true --no-build
+    dotnet publish "EssentialCSharp.Web.slnx" -c Release -p:PublishDir=/app/publish -p:UseAppHost=false -p:SkipFrontendBuild=true --no-build && \
+    mv nuget.config.bak nuget.config
 
 FROM base AS final
 WORKDIR /app