Package source mapping doesn't work with Maestro added feeds

[ViktorHofer]

• This issue is blocking
• This issue is causing unreasonable pain

Came up in dotnet/format#1987

When using NuGet Central Package Management with more than one NuGet feed, package source mapping must be used: https://learn.microsoft.com/en-us/nuget/consume-packages/central-package-management#warning-when-using-multiple-package-sources

Unfortunately, Maestro (?) doesn't support this model as it dynamically adds feeds when producing stabilized package versions (in RTM and servicing mode). Therefore, repositories that started using CPM had to add a NoWarn=NU1507 setting to make CPM work.

I see package source mapping as a useful feature that our infrastructure shouldn't block using. Here's some more history on this: dotnet/arcade#9885 (comment)

cc @mmitche @ChadNedzlek

[riarenas]

Moving this issue to arcade-services where the Maestro team can take a look.

[richlander]

Maestro could add a package source mapping when it adds a new source.

Using the referenced PR, this would look like:

    <packageSource key="darc-pub-dotnet-runtime-488a8a3">
      <package pattern="System.*" />
      <package pattern="Microsoft.*" />
    </packageSource>

That seems pretty reasonable while enabling the broad team to adopt PSM. The value of PSM is the additional transparency with dotnet-public where we don't use wildcards.

https://github.com/dotnet/format/pull/1987/files#diff-9c5952957709545aad811b400e7e516eebade1e44fc4fbc23203403ffeb92c34L40-L63