[release/10.0.1xx] Backport remaining CFSClean fixes - #12396

Internal [build 14925232](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=14925232) reported CFSClean violations during **Create MAUI template**. The pipeline needs to suppress three independent .NET network paths:

1. `DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE=true` prevents background workload advertising-manifest updates.
2. `DOTNET_SDK_VULNERABILITY_CHECK_DISABLE=true` prevents the .NET CLI's separate background SDK release/vulnerability/EOL metadata refresh. The SDK invokes this refresh from restoring commands such as `dotnet build` and `dotnet restore`.
3. `NuGetAudit=false` disables NuGet restore's package-advisory lookup. This is a distinct MSBuild property and does not replace the SDK-level variable.

The immediate MAUI violation came from `dotnet new maui`, which runs a restore post-action by default. That restore had no project-specific `NuGet.config`, so it contacted public NuGet and workload advertising-manifest hosts. Passing `--no-restore` creates the template without running that post-action.

This does not remove the intended MAUI restore/build. The following Debug and Release build steps remain unchanged and explicitly pass `--configfile $(Build.SourcesDirectory)/maui/NuGet.config`, keeping package acquisition on the configured sources. Disabling these metadata checks also does not disable package hash/signature validation; it prevents external metadata lookups in network-isolated jobs.

- Retain `DOTNET_SDK_VULNERABILITY_CHECK_DISABLE=true` and add `NuGetAudit=false` alongside it in shared pipeline variables and the internal override.
- Add `--no-restore` to MAUI template creation in the main, public, and internal pipeline definitions.

- Parsed all changed YAML files successfully.
- Ran `git diff --check`.
- Verified every MAUI template-creation variant uses `--no-restore`.
- Verified all three isolation controls remain present where expected.
- Verified `dotnet new --no-restore` creates a project without producing a restore assets file.
- Confirmed the separate SDK behavior in [`RestoringCommand`](https://github.com/dotnet/sdk/blob/8795d0128cf1efbb900edd5cfbd8e9789be10653/src/Cli/dotnet/Commands/Restore/RestoringCommand.cs) and [`SdkReleaseMetadataCache`](https://github.com/dotnet/sdk/blob/8795d0128cf1efbb900edd5cfbd8e9789be10653/src/Cli/dotnet/SdkVulnerability/SdkReleaseMetadataCache.cs).

Co-authored-by: Copilot App <[email protected]>

- declare the standard `skipRestore` symbol in every Android project template
- map `skipRestore` to the user-facing `--no-restore` option through each template's `dotnetcli.host.json`
- prevent `XASdkTests.DotNetNew` from restoring generated projects implicitly
- copy the repository `NuGet.config` into generated projects before builds restore
- route `AndroidMavenLibrary` items with blank repository metadata through `dotnet-public-maven` in test scope

`--no-restore` is presented as a standard `dotnet new` option, but project templates must opt into accepting it by declaring a `skipRestore` boolean symbol and mapping that symbol to `--no-restore` in `dotnetcli.host.json`. This follows the symbol/mapping convention used by the .NET SDK and .NET MAUI templates.

The Android templates intentionally do not add a restore post-action. They therefore preserve their existing default behavior and avoid restoring before test call sites configure approved package versions and feeds. The new option lets `XASdkTests` explicitly document and enforce that expectation before copying the repository `NuGet.config` into generated projects.

Co-authored-by: Copilot App <[email protected]>

Depends on #12336.

The Windows template smoke project is generated under `$(Build.StagingDirectory)`, outside the repository `NuGet.config` hierarchy. Its implicit build restore therefore falls back to the agent's machine NuGet configuration and may access unapproved package feeds.

- Pass `RestoreConfigFile=$(System.DefaultWorkingDirectory)\NuGet.config` to the template build.
- Quote the template creation and build staging paths using Windows path syntax.

Co-authored-by: Copilot App <[email protected]>

`CodeBehindTests` passed a file path to `CopyNuGetConfig`, which expects a directory and appends `NuGet.config`. This placed the repository configuration in a nested path, so generated projects could miss it and contact external package feeds. Pass the temporary project root instead.

Co-authored-by: Copilot App <[email protected]>