feat(ir): add typed builder for NuGetAuthenticate@1

[github-actions]

Summary

Adds a typed builder struct for NuGetAuthenticate@1 to the ado-aw IR and migrates both stringly-typed call sites to use it.

Motivation

Two places in the codebase hand-crafted TaskStep::new("NuGetAuthenticate@1", ...) with raw string input keys:

• src/compile/agentic_pipeline.rs — nuget_authenticate_step(), used for supply-chain feed auth across all three pipeline jobs (Agent, Detection, SafeOutputs)
• src/runtimes/dotnet/extension.rs — nuget_authenticate_task_step(), used by the .NET runtime extension

This PR introduces a typed builder so required inputs are positional (none here — all inputs are optional), optional inputs and their constrained values are type-checked, and call sites stop using stringly-typed keys.

Changes

• src/compile/ir/tasks/nuget_authenticate.rs: new NuGetAuthenticate builder struct with:
  • nuget_service_connections(conn) — for cross-org/external feeds
  • force_reinstall_credential_provider(bool) — reinstall credential provider
  • workload_identity_service_connection(conn) — workload-identity federation auth
  • feed_url(url) — Azure Artifacts feed URL (paired with WIF connection)
  • with_display_name(name) — display name override
  • #[cfg(test)] mod tests — 6 unit tests
• src/compile/ir/tasks/mod.rs: pub mod nuget_authenticate; declaration (alphabetical order)
• src/compile/agentic_pipeline.rs: nuget_authenticate_step migrated from raw TaskStep::new to typed NuGetAuthenticate builder; import added
• src/runtimes/dotnet/extension.rs: nuget_authenticate_task_step migrated from raw TaskStep::new to typed NuGetAuthenticate builder; import added

ADO Task Reference

• Task: NuGetAuthenticate@1
• Docs: (https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/nuget-authenticate-v1)
• Required inputs: (none)
• Optional inputs: nuGetServiceConnections, forceReinstallCredentialProvider, workloadIdentityServiceConnection, feedUrl

Validation

• cargo build --all-targets
• cargo test (2091 tests pass)
• cargo clippy --all-targets --all-features --workspace -- -D warnings

---

Created by the ado-task-ir-contributor workflow.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• spsprodeus21.vssps.visualstudio.com
• spsprodweu4.vssps.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "spsprodeus21.vssps.visualstudio.com"
    - "spsprodweu4.vssps.visualstudio.com"

See Network Configuration for more information.

Generated by ADO Task IR Contributor · 713.9 AIC · ⌖ 30.5 AIC · ⊞ 38K · ◷