fix: remove credentials file before layer is committed

Deleting ~/.nuget/config/credentials.config in the same RUN instruction
ensures the PAT never appears in the final layer snapshot (create + delete
in one RUN = net zero diff). Prevents credential leakage into BuildKit
layer cache.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: BenjaminMichaelis

EssentialCSharp.Web/Dockerfile

@@ -25,7 +25,8 @@ RUN --mount=type=secret,id=nugetconfig,required=false \
     fi && \
     dotnet restore "EssentialCSharp.Web.slnx" -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED && \
     dotnet build "EssentialCSharp.Web.slnx" -c Release --no-restore -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED -p:ReleaseDateAttribute=True -p:SkipFrontendBuild=true && \
-    dotnet publish "EssentialCSharp.Web.slnx" -c Release -p:PublishDir=/app/publish -p:UseAppHost=false -p:SkipFrontendBuild=true --no-build
+    dotnet publish "EssentialCSharp.Web.slnx" -c Release -p:PublishDir=/app/publish -p:UseAppHost=false -p:SkipFrontendBuild=true --no-build && \
+    rm -f ~/.nuget/config/credentials.config
 
 FROM base AS final
 WORKDIR /app