Fix NuGet central package restore warnings from mixed sources and vulnerable Xml transitive dependency

[Copilot]

Restore was emitting NU1507 because central package management was used with two package sources but no source mapping. It was also surfacing NU1903 because Microsoft.DotNet.Interactive.CSharpProject pulled in System.Security.Cryptography.Xml 10.0.0.

• Package source mapping

  • Added packageSourceMapping to NuGet.config
  • Kept nuget.org as the default source
  • Scoped Microsoft.DotNet.Interactive* packages to the dotnet-tools feed

• Central transitive pinning

  • Enabled CentralPackageTransitivePinningEnabled in Directory.Packages.props
  • Pinned System.Security.Cryptography.Xml to 10.0.11 centrally so the vulnerable transitive version is overridden without adding per-project package references

• Resulting restore behavior

  • Packages now resolve from explicit sources under central package management
  • Projects that transitively depend on Microsoft.DotNet.Interactive.CSharpProject resolve the patched Xml package version

<PropertyGroup>
  <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
  <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
</PropertyGroup>

<ItemGroup>
  <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.11" />
</ItemGroup>

[Copilot]

Pull request overview

This PR addresses NuGet restore warnings by adding package source mapping for central package management and mitigating a vulnerable transitive dependency by centrally pinning a patched System.Security.Cryptography.Xml version.

Changes:

• Added packageSourceMapping in NuGet.config to map Microsoft.DotNet.Interactive* packages to the dotnet-tools feed while keeping nuget.org as the general source.
• Enabled central transitive pinning and pinned System.Security.Cryptography.Xml to 10.0.11 in Directory.Packages.props to override the vulnerable transitive version.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
NuGet.config	Adds package source mapping to eliminate NU1507 under central package management with mixed sources.
Directory.Packages.props	Enables transitive central pinning and pins System.Security.Cryptography.Xml to a patched version to address NU1903.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.