build: migrate to CFS

[hallvictoria]

Description

Onboards all Python worker pipeline dependency restores to the Azure Artifacts public/upstream-public feed, eliminating direct traffic to PyPI and api.nuget.org.

Changes

pip / uv (Python packages)

• All PipAuthenticate@1 steps now use public/upstream-public with onlyAddExtraIndex: false, routing pip restores through the CFS
• Shell scripts forward PIP_INDEX_URL (set by PipAuthenticate) to UV_DEFAULT_INDEX so uv respects the same feed
• Removed --prerelease=allow from the main uv install command, replacing it with --prerelease=if-necessary-or-explicit to prevent transitive dependencies (e.g. aiohttp 4.0.0a1) from resolving to pre-release versions unnecessarily
• pip-audit removed from all vulnerability scan steps

NuGet (.NET packages)

• nuget.config updated to use upstream-public as the single package source
• Removed the per-build "Configure NuGet feed" bash steps that conditionally sed-patched nuget.config at runtime
• ArtifactFeed and NuGetServiceConnection parameters removed from job templates and all call sites

Fixes #

---

Pull Request Checklist

Host-Worker Contract

• Does this PR impact the host-worker contract (e.g., gRPC messages, shared interfaces)?
  • If yes, have the changes been applied to:
    • azure_functions_worker (Python <= 3.12)
    • proxy_worker (Python >= 3.13)
  • If no, please explain why:

Worker Execution Logic

• Does this PR affect worker execution logic (e.g., function invocation, bindings, lifecycle)?
  If yes, please answer the following:

Python Version Coverage

• Does this change apply to both Python <=3.12 and 3.13+?
• If yes, have the changes been made to:
  • azure_functions_worker (Python <= 3.12)
  • runtimes/v1 / runtimes/v2 (Python >= 3.13)
• If no, please explain why:

Programming Model Compatibility (for Python 3.13+)

• Does this change apply to both:
  • V1 programming model (runtimes/v1)?
  • V2 programming model (runtimes/v2)?
• Explanation (if limited to one model):