ci: use Central Feed Services for release builds

Explicitly use Central Feed Services (CFS) feeds for NuGet packages by
replacing the normal, nuget.org, config file in the repo root at the
start of the build jobs.

Run NuGetAuthenticate once at the start of each job that restores
(Windows, macOS, Linux, and the .NET tool packaging job) so every
subsequent dotnet restore/publish is authenticated. The release-stage
NuGet publish job is unaffected: it pushes via the 1ES service
connection rather than a restore.

Assisted-by: Claude Opus 4.8
Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>

Author: mjcheetham

.azure-pipelines/nuget.config

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This Nuget config file is only used in release builds to redirect all
+NuGet package sources to the Central Feed Services (CFS) feed.
+-->
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="CFS" value="https://pkgs.dev.azure.com/mseng/1ES/_packaging/1ES_PublicPackages/nuget/v3/index.json" />
+  </packageSources>
+</configuration>

.azure-pipelines/release.yml

@@ -134,6 +134,15 @@ extends:
                     artifactName: '${{ dim.runtime }}'
               steps:
                 - checkout: self
+                - task: CopyFiles@2
+                  displayName: 'Use Central Feed Services (CFS)'
+                  inputs:
+                    SourceFolder: '$(Build.SourcesDirectory)\.azure-pipelines'
+                    Contents: 'nuget.config'
+                    TargetFolder: '$(Build.SourcesDirectory)'
+                    Overwrite: true
+                - task: NuGetAuthenticate@1
+                  displayName: 'Authenticate to NuGet feeds'
                 - task: PowerShell@2
                   displayName: 'Install .NET 10 SDK'
                   inputs:
@@ -281,6 +290,15 @@ extends:
                     artifactName: '${{ dim.runtime }}'
               steps:
                 - checkout: self
+                - task: CopyFiles@2
+                  displayName: 'Use Central Feed Services (CFS)'
+                  inputs:
+                    SourceFolder: '$(Build.SourcesDirectory)/.azure-pipelines'
+                    Contents: 'nuget.config'
+                    TargetFolder: '$(Build.SourcesDirectory)'
+                    Overwrite: true
+                - task: NuGetAuthenticate@1
+                  displayName: 'Authenticate to NuGet feeds'
                 - task: UseDotNet@2
                   displayName: 'Use .NET 10 SDK'
                   inputs:
@@ -422,6 +440,15 @@ extends:
                     artifactName: '${{ dim.runtime }}'
               steps:
                 - checkout: self
+                - task: CopyFiles@2
+                  displayName: 'Use Central Feed Services (CFS)'
+                  inputs:
+                    SourceFolder: '$(Build.SourcesDirectory)/.azure-pipelines'
+                    Contents: 'nuget.config'
+                    TargetFolder: '$(Build.SourcesDirectory)'
+                    Overwrite: true
+                - task: NuGetAuthenticate@1
+                  displayName: 'Authenticate to NuGet feeds'
                 - task: UseDotNet@2
                   displayName: 'Use .NET 10 SDK'
                   inputs:
@@ -499,6 +526,15 @@ extends:
                   artifactName: 'dotnet-tool'
             steps:
               - checkout: self
+              - task: CopyFiles@2
+                displayName: 'Use Central Feed Services (CFS)'
+                inputs:
+                  SourceFolder: '$(Build.SourcesDirectory)/.azure-pipelines'
+                  Contents: 'nuget.config'
+                  TargetFolder: '$(Build.SourcesDirectory)'
+                  Overwrite: true
+              - task: NuGetAuthenticate@1
+                displayName: 'Authenticate to NuGet feeds'
               - task: UseDotNet@2
                 displayName: 'Use .NET 10 SDK'
                 inputs: