Publish the .NET SDK to NuGet with trusted publishing #1975

Tracks PR #1974.

Plan

Goal: Publish the generated .NET SDK to NuGet with trusted publishing (GitHub OIDC exchanged for a short-lived API key) instead of the expired long-lived NUGET_TOKEN secret, so the next generated release doesn't bring the broken workflow back.

What changes:

• ci(dotnet): publish to NuGet with trusted publishing #1974 updates templates/dotnet/.github/workflows/publish.yml.twig: adds job permissions (contents: read, id-token: write), a NuGet/login step pinned to v1.2.0 with user from the NUGET_USER repository variable, and pushes with steps.login.outputs.NUGET_API_KEY.
• ci: publish to NuGet with trusted publishing sdk-for-dotnet#105 makes the same change to the live .github/workflows/publish.yml (the 8.1.0 publish failed with 403 because the old key expired). The rendered template is meant to be byte-identical to it.

Remaining steps:

1. Merge ci: publish to NuGet with trusted publishing sdk-for-dotnet#105 and ci(dotnet): publish to NuGet with trusted publishing #1974.
2. Add the nuget.org Trusted Publishing policy (owner Appwrite, repo appwrite/sdk-for-dotnet, workflow publish.yml, no environment) and set the NUGET_USER repository variable on appwrite/sdk-for-dotnet. Reported done in ci: publish to NuGet with trusted publishing sdk-for-dotnet#105.
3. Retry the .NET release and confirm the package lands on NuGet.

Done when:

• ci(dotnet): publish to NuGet with trusted publishing #1974 and ci: publish to NuGet with trusted publishing sdk-for-dotnet#105 are merged
• The trusted publishing policy and NUGET_USER variable are in place (per sdk-for-dotnet#105)
• A .NET SDK release publishes to NuGet without NUGET_TOKEN