build(dotnet): add lock file support and centralize build props

[erlendellefsen]

This is ported from how I solved lock files in https://github.com/intility/sec-center, adapted for the templates. This is my best solution so far. This should be properly tested and iterated on, just thought i could save you some time researching 😄

---

This adds lock file support so NuGet restores are reproducible in Linux container builds.

Directory.Build.props and Directory.Solution.targets are the natural place for this. MSBuild picks them up automatically for every project in the solution, so we don't have to repeat the same settings in each .csproj. The targets file handles the cross-platform problem: on macOS/Windows it re-runs restore targeting Linux after every normal restore, keeping the lock files in sync. This way you do not need to have three lock files per project, all kept in sync.

Test projects are opted out (RestorePackagesWithLockFile: false) since they're never published, so there's no point enforcing a lock file on them. This is also because dependabot does not seem to support updating lock files in included projects. I could possibly be solved by utilizing central package management with a Directory.Packages.props file, but i have not tested this yet.

Also added NuGet audit. It runs on every restore, checks all packages against known CVEs, and warns on anything moderate or above. It will not fail any restores as TreatWarningsAsErrors is not enabled

---

Some references:
NuGet/Home#9195
dotnet/sdk#14281
NuGet/Home#8287

[erlendellefsen]

For fully-reproducable builds we should consider a global.json as well to pin the SDK? Example