Route dependency restores through CFS

[fabiocav]

Summary

• route Azure Pipelines Python installs through public/upstream-public with PipAuthenticate@1 before Python acquisition
• route nox, dev-container, and repository deployment-script Python installs through the CFS PyPI endpoint
• add a root NuGet.config with <clear />, a single CFS package source, and detached-tree propagation for Functions extension restore
• preserve GitHub fork validation on its existing public index because fork pull-request workflows cannot access Azure Artifacts credentials and CFS rejects uncached anonymous package downloads
• keep customer sample requirements and documentation examples unchanged; this repository has no build-owned npm manifest
• exclude feed and credential configuration from Python distribution artifacts

Validation

• downloaded the complete Python requirements graph into empty cache/wheel directories: 88 wheels, only pkgs.dev.azure.com and Azure Artifacts blob hosts, with zero pypi.org or pythonhosted.org requests
• restored samples/aml_monitoring/extensions.csproj using isolated global-packages, HTTP, and plugin caches from a path containing spaces: only pkgs.dev.azure.com, no nuget.org traffic
• ran 333 tests on Python 3.13
• parsed all changed YAML and NuGet.config; validated shell syntax
• built sdist and wheel; audited 573 manifest entries with no NuGet.config, .npmrc, pip config, lockfile, node_modules, or credential files