Route dependency restores through CFS

[Fabio Cavalcante (fabiocav)]

Summary

• add a repository NuGet.config that clears inherited sources and maps every package to azfunc/public/upstream-public
• authenticate each Azure Pipelines restore entry point and pass the repository config explicitly
• make the GitHub CodeQL restore use the repository config, install the repository's .NET 6 SDK generation, and lock the build to --no-restore
• preserve the customer-facing npm and Python samples; repository CI has no npm or pip install path to repoint

Validation

• restored the full solution from empty NuGet global-packages, HTTP, and plugin caches under paths containing spaces using a PowerShell argument array
• observed 1,514 NuGet HTTP operations, all against pkgs.dev.azure.com; observed no requests to nuget.org
• repeated a cold product restore with .NET SDK 8.0.423: 1,335 CFS log references and no direct NuGet host
• verified an anonymous CFS package download returned HTTP 200
• built the full solution in Release with --no-restore
• passed 39 memory-transport tests
• packed all six product and symbols packages with --no-build --no-restore
• inspected package manifests: no NuGet/npm/pip config, credentials, lockfiles, or node_modules
• ran dotnet package list --vulnerable --include-transitive --no-restore through the repository config; it reports existing transitive advisories unrelated to this routing change
• passed the upstream CodeQL and CLA checks

The first CodeQL run exposed a cold-cache .NET 6 apphost that anonymous users could not save into the upstream feed. Installing .NET 6 supplies the matching local targeting/apphost packs without adding credentials or a forbidden public fallback. The excluded sample-only npm and pip probes contacted CFS (and no npmjs.org/PyPI hosts) before reaching the expected unauthenticated 401 boundary; no feed config or credentials were added to those customer artifacts.