Bump current XBD packages for fixed AAR packaging

[jonathanpeppers]

Issue #1538 shows that already-published packages still use the old Xamarin.Build.Download templates, embedding proprietary AARs while also downloading them for consumers. The shared template fix from #1520 prevents this, but immutable current NuGet packages and their published reverse dependencies need new revisions to deliver it.

This change:

• Bumps the remaining 193 published current XBD AAR packages not already covered by the merged Pin Protobuf JavaLite to 3.25.8 #1537.
• Bumps 14 published reverse-dependent packages whose existing nuspecs would otherwise retain dependency ranges starting at defective current XBD revisions.
• Regenerates Component Governance metadata and the artifact-version inventory.

Historical dependency-only package versions remain unchanged. This PR intentionally limits the fix to the current package graph and contains no binderator code changes.

Fixes #1538

[Copilot]

Pull request overview

This PR revises the NuGet revision (nugetVersion 4th component) for all currently published Xamarin.Build.Download (XBD) AAR-based packages so they can be regenerated and re-published using the fixed XBD packing templates (from #1520), avoiding duplicate inclusion of proprietary AARs (and eliminating duplicate XA4301 native-library warnings such as in Xamarin.Firebase.Crashlytics.NDK).

Changes:

• Bumped nugetVersion by one revision across the affected published XBD AAR packages (e.g., 120.1.0 → 120.1.0.1 for Crashlytics / Crashlytics.NDK).
• Left Maven version values unchanged; this is strictly a NuGet re-release to pick up packaging/template fixes.
• Included all relevant Crashlytics/Crashlytics.NDK entries implicated by #1538 so regenerated packages no longer embed + download the same AARs.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[jonathanpeppers]

@dalexsoto review

[dalexsoto]

The 193 direct XBD bumps and regenerated inventories are internally consistent, but two end-to-end publication blockers remain.

1. Complete the published reverse-dependency revision closure. Fourteen already-published packages keep immutable versions whose nuspecs still point to the pre-fix XBD revisions (config.json:177,782,824,2123,2372,2624-2673,2718,3669,5248,5473-5523): Xamarin.AndroidX.Camera.MLKit.Vision, Core.GoogleShortcuts, Credentials.PlayServicesAuth, Wear.RemoteInteractions, Work.GCM, Xamarin.Google.AI.Edge.LiteRT, LiteRT.Support, LiteRT.Support.API, TransportBackendCct, AppActions.Suggestions, Xamarin.KotlinX.Coroutines.Play.Services, and the Audio/Text/Vision TensorFlow Lite Play Services task packages. NuGet selects the lowest applicable dependency, so consumers of these higher-level packages continue restoring the defective published XBD revisions even after the 193 direct packages are republished. Each current version is occupied and the next revision is free; bump all fourteen, then regenerate cgmanifest.json and the artifact-version table.

2. Replace the historical dependency-only XBD packages. The exact mappings at config.json:5605-5637 still route the newly revised Gass, Ads Lite, and Firebase Analytics Impl packages to Xamarin.GooglePlayServices.Ads.Base 120.0.0, Ads.Lite 120.0.0, Ads.Base 124.0.0.1, and Measurement.Base 116.3.0. Those published nupkgs still contain duplicate XamarinBuildDownloadAndroidAarLibrary registrations; Ads Base 124.0.0.1 and the already-published .2 also embed the AAR, so .3 is the first usable revision. Because dependency-only entries are skipped by normal binderator project generation, this PR cannot regenerate those packages as written. Publish fixed successors (120.0.0.1, 120.0.0.1, 124.0.0.3, and 116.3.0.1 respectively), update the four mappings, and regenerate their parent packages and inventories.

[jonathanpeppers]

Addressed both review blockers in 3509dce5d:

• Bumped the 14-package published reverse-dependency closure and regenerated the inventories.
• Added opt-in generation for the four historical dependency-only XBD packages, using unique project/external paths and project references so their unpublished successor versions build in the same release graph.

Full binderation and metadata validation pass. The generated historical projects each have one downloaded AAR registration, no packed AAR, and no PublicAPI references.

[jonathanpeppers]

Scope update in 19389c334: removed the historical dependency-only package generation mechanism and reverted those four proposed successor versions. The PR is config-only again and keeps the 14-package reverse-dependency closure for the current package graph; historical packages are intentionally out of scope.

[jonathanpeppers]

@dalexsoto review