Update NuGet auditing details for dotnet restore

[meaghanlewis]

Summary

This pull request updates the documentation for NuGet security auditing in the context of dotnet restore, focusing on new configuration options available in .NET 9 and clarifying how vulnerability data sources are specified.

NuGet security auditing configuration:

• Added documentation for the new auditSources element in nuget.config, available starting in .NET 9, which allows specifying sources for vulnerability data separately from package sources. If no audit sources are defined, package sources are used by default.
• Provided an updated example for listing NuGet.org as an audit source using the auditSources configuration block.
• Clarified that NuGet audits any source as long as it provides the VulnerabilityInfo resource, and removed outdated information about package sources.

Contributes to #39212

---

Internal previews

📄 File	🔗 Preview link
docs/core/tools/dotnet-restore.md	dotnet restore

[zivkan]

LGTM, thank you!

[Copilot]

Pull request overview

This PR updates the NuGet security auditing documentation for dotnet restore to reflect new .NET 9 capabilities and improve clarity around vulnerability data source configuration.

Key changes:

• Documents the new auditSources configuration element available in .NET 9 for specifying vulnerability data sources separately from package sources
• Updates the example configuration to demonstrate the auditSources element instead of packageSources
• Clarifies the fallback behavior when no audit sources are configured