[Fix]Release pipeline compliance

[weiyuanyue]

This change enforces single‑feed supply‑chain governance for the Azure DevOps (ADO) release pipeline while keeping the GitHub Actions (GA) PR pipeline simple and stable. Concretely:

• Mirrored Microsoft.ML.OnnxRuntime.Foundry 1.23.2 into the project feed pde-oss_Internal (ADO needs this version during release).
• Created a nuget.config.template for Local development
• Removed the repo’s GA nuget.config and generate an ephemeral config at runtime inside GA (so the file is not scanned by ADO’s SSCA detectors).

This simultaneously clears SSCA findings on ADO and preserves GA’s current behavior for PR validation.

Background

• SSCA/CFS policy requires ADO builds to restore from a single Azure Artifacts feed in our own project (no direct nuget.org, no cross‑org feeds, first).
• The GA/Local nuget.config in the repo pointed at multiple sources (including a cross‑org ORT feed). When present in the repo, ADO’s SSCA scans it and flags non‑compliance.
• We also need Foundry runtime packages on ADO release; the version currently required is Microsoft.ML.OnnxRuntime.Foundry 1.23.2.

What’s changed

Release (ADO):

• Ensure Foundry dependency availability by mirroring Microsoft.ML.OnnxRuntime.Foundry 1.23.2 into pde-oss_Internal.

PR (GA):

• Delete the repo’s GA nuget.config.
• Create a short‑lived, ephemeral NuGet config at runtime inside GA with the exact source mapping GA needs. The ephemeral file lives only on the runner and is not committed, hence not scanned by ADO SSCA.

Security & Compliance

• ADO: Single source (pde-oss_Internal) + satisfies SSCA/CFS; cross‑org and nuget.org references are not present in any repo config file consumed by release.
• GA: Ephemeral config exists only on the runner; since it’s not committed, ADO cannot see or scan it, eliminating the multi‑feed/cross‑org finding pathway.
• Provenance: Foundry package Microsoft.ML.OnnxRuntime.Foundry 1.23.2 is available from the project feed, ensuring deterministic resolution at release.