fix: switch NuGet auth to config layering to preserve packageSourceMapping

Replace --configfile (which drops all other NuGet config) with copying a
credentials-only file to ~/.nuget/config/credentials.config so NuGet
merges it with the repo's nuget.config (including packageSourceMapping).

- Add required=false to secret mount (explicit optional behavior)
- Generate credentials-only config in CI (nuget.config remains single
  source of truth for feeds and packageSourceMapping)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: BenjaminMichaelis

EssentialCSharp.Web/Dockerfile

@@ -18,12 +18,12 @@ ENV ACCESS_TO_NUGET_FEED=$ACCESS_TO_NUGET_FEED
 WORKDIR /src
 COPY . .
 COPY --from=frontend-build /frontend/EssentialCSharp.Web/wwwroot/dist ./EssentialCSharp.Web/wwwroot/dist
-RUN --mount=type=secret,id=nugetconfig \
+RUN --mount=type=secret,id=nugetconfig,required=false \
     if [ "$ACCESS_TO_NUGET_FEED" = "true" ] && [ -f /run/secrets/nugetconfig ]; then \
-      dotnet restore "EssentialCSharp.Web.slnx" --configfile /run/secrets/nugetconfig -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED; \
-    else \
-      dotnet restore "EssentialCSharp.Web.slnx" -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED; \
+      mkdir -p ~/.nuget/config && \
+      cp /run/secrets/nugetconfig ~/.nuget/config/credentials.config; \
     fi && \
+    dotnet restore "EssentialCSharp.Web.slnx" -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED && \
     dotnet build "EssentialCSharp.Web.slnx" -c Release --no-restore -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED -p:ReleaseDateAttribute=True -p:SkipFrontendBuild=true && \
     dotnet publish "EssentialCSharp.Web.slnx" -c Release -p:PublishDir=/app/publish -p:UseAppHost=false -p:SkipFrontendBuild=true --no-build