Fix NuGet publish and add GitHub Release workflow

[joneja09]

The merge to main failed Windows CI because the leftover IdentityServer4 job still ran ./build.ps1 sign (dotnetfoundation SignClient) and dotnet nuget push to myget.org/F/identity with an empty MYGET secret.

Yes, the NuGet push needed to be fixed. It now uses Trusted Publishing (GitHub OIDC) instead of MyGet or a long-lived API key.

Changes

• CI on every OS just builds and tests (./build.sh / ./build.ps1). No signing, no MyGet.
• Release workflow on *.*.* tags (and workflow_dispatch): pack, GitHub Release, nuget.org via NuGet/login@v1 when NUGET_USER is set.
• id-token: write so the job can request a GitHub OIDC token.
• fetch-depth: 0 so MinVer can see tags.
• Package project URL updated to the renamed GitHub repo.
• Windows build.ps1 now stops if a sub-project build fails.

nuget.org Trusted Publishing (one-time, in your nuget.org account)

1. nuget.org → Trusted Publishing → add a policy:
   • Repository Owner: joneja09
   • Repository: ForgePoint.Identity
   • Workflow File: release.yml
   • Environment: empty
2. GitHub repo Settings → Secrets and variables → Actions → Variables: NUGET_USER = your nuget.org profile name (not email).
3. Merge this PR, then Actions → Release → Run workflow with tag 10.0.0 to push the already-cut GitHub Release packages to nuget.org.

Release

ForgePoint.Identity 10.0.0 is on GitHub with the five nupkgs attached.

Test plan

• Local ./build.sh on tag 10.0.0; nupkgs are 10.0.0
• GitHub Release 10.0.0 with five ForgePoint.Identity nupkgs
• CI green on the previous revision of this PR
• CI green after Trusted Publishing workflow change
• nuget.org publish after NUGET_USER + Trusted Publishing policy