Update for publishing and package source mappings

[NikolaMilosavljevic]

Fixes: dotnet/source-build#4287
Fixes: dotnet/source-build#4204
Fixes: dotnet/source-build#4205

Description of findings

Source-build has always had multiple versions of packages produced by roslyn-analyzers and symreader - stable and unstable package versions, i.e.

Microsoft.CodeAnalysis.NetAnalyzers.9.0.0.nupkg
Microsoft.CodeAnalysis.NetAnalyzers.9.0.0-preview.24203.1.nupkg

These packages would end up in PSB artifacts archive.

PVP flow would use the first encountered package version, so any consumers of Microsoft.CodeAnalysis.NetAnalyzers would get version 9.0.0.

We wanted to fix NuGet non-determinism by carefully populating package source mappings for previously-source-built feed. However, we did allow package mapping for a package ID that has any version not present in current (live) package sources. Therefore, there would be a mapping in PSB feed for Microsoft.CodeAnalysis.NetAnalyzers. And there would be two identically-version packages (9.0.0), with different content - one in current sources, and one in PSB.

roslyn repo did not have a dependency on roslyn-analyzers repo, so it did not have access to those packages in current feeds. The only available package was in PSB, and this was causing a poison leak.

Changes

• Add roslyn-analyzers and symreader dependencies to roslyn as there are packages consumed from both.
• Modify package-source mappings task to not add a mapping for a package in PSB, if any of PSB package versions are present in current (live) package sources.
• Stop publishing of additional packages in roslyn-analyzers - prevents publishing of stable-versioned packages
• Stop publishing of additional packages in symreader - prevents publishing of stable-versioned packages

[ViktorHofer]

I will let @MichaelSimons and @mthalman review the source-build specific changes (roslyn.proj and the task update) but this looks great.

[MichaelSimons]

This will be a nice improvement.