[ci] Prevent isolated NuGet access

[jonathanpeppers]

Why

Internal build 14925232 reported CFSClean violations during Create MAUI template. Two independent behaviors allowed network access:

1. DOTNET_SDK_VULNERABILITY_CHECK_DISABLE is not NuGet's supported restore-audit switch and did not prevent the build from requesting NuGet's vulnerability index. NuGet audit is controlled by the MSBuild property NuGetAudit; Azure Pipeline variables are exported to the task environment and imported by MSBuild as properties, so NuGetAudit=false disables that advisory lookup pipeline-wide.
2. dotnet new maui runs a restore post-action by default. That restore had no project-specific NuGet.config, so it contacted public NuGet and workload advertising-manifest hosts. Passing --no-restore creates the template without running that post-action.

This does not remove the intended MAUI restore/build. The following Debug and Release build steps remain unchanged and explicitly pass --configfile $(Build.SourcesDirectory)/maui/NuGet.config, keeping package acquisition on the configured sources. Disabling NuGet audit also does not disable package hash/signature validation; it only suppresses the external vulnerability-advisory lookup in these network-isolated jobs.

Changes

• Use NuGetAudit=false in the shared pipeline variables and internal override.
• Add --no-restore to MAUI template creation in the main, public, and internal pipeline definitions.

Validation

• Parsed all four changed YAML files successfully.

• Ran git diff --check.

• Verified every MAUI template-creation variant uses --no-restore and no obsolete audit variable remains.

• Verified dotnet new --no-restore creates a project without producing a restore assets file.

• Useful description of why the change is necessary.

• Links to issues fixed (build link above; no GitHub issue).

• Unit tests (not applicable to pipeline-only YAML; targeted checks listed above).

[Copilot]

Pull request overview

This PR updates the CI pipelines to prevent unintended external network access during MAUI template creation in network-isolated jobs by disabling NuGet’s vulnerability-audit advisory lookup and avoiding dotnet new’s implicit restore.

Changes:

• Replaces DOTNET_SDK_VULNERABILITY_CHECK_DISABLE with NuGetAudit=false in shared/internal pipeline variables.
• Adds --no-restore to dotnet new maui invocations across main, public, and internal pipeline definitions.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
build-tools/automation/yaml-templates/variables.yaml	Sets NuGetAudit=false as the shared pipeline variable to disable NuGet audit advisory lookups.
build-tools/automation/azure-pipelines.yaml	Adds --no-restore to MAUI template creation to prevent implicit restore network access.
build-tools/automation/azure-pipelines-public.yaml	Adds --no-restore to MAUI template creation in the public pipeline.
build-tools/automation/azure-pipelines-internal.yaml	Switches internal override to NuGetAudit=false and adds --no-restore to MAUI template creation.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[jonathanpeppers]

Superseded by #12336, which uses the same commit from an upstream branch so #12336 and #12335 can be represented as a native GitHub stacked PR.