Pin patched REST client runtime on dev5x

[saurabhsathe-ms]

Description

The dev5x Build and pack Wilson for ID Web E2E tests task runs dotnet pack Wilson.sln, which restores test projects with NuGet audit enabled. Microsoft.Azure.KeyVault 3.0.0 resolves Microsoft.Rest.ClientRuntime 2.3.11, which is affected by GHSA-whph-446h-6m9v. Because the repository treats warnings as errors, NU1902 stops the pack.

This change pins Microsoft.Rest.ClientRuntime 2.3.24, the patched version, at the Microsoft.IdentityModel.KeyVaultExtensions production dependency boundary. Version 2.3.24 satisfies Microsoft.Azure.KeyVault's declared [2.3.11, 3.0.0) range and propagates to the dependent KeyVault test and package graphs.

Changes

• Add central MicrosoftRestClientRuntimeVersion=2.3.24.
• Add an explicit Microsoft.Rest.ClientRuntime package reference to Microsoft.IdentityModel.KeyVaultExtensions.
• Do not suppress NU1902 or disable NuGet audit.

Validation

Reproduced the original failure on merged dev5x using the package-feed proxy.

Validated the exact solution-wide pack shape with audit enabled:

dotnet pack Wilson.sln `
  --output artifacts\3P `
  "/p:Configuration=Release;placeholder=;MicrosoftIdentityModelVersion=5.7.2" `
  --verbosity Minimal `
  --source https://packagefeedproxy.microsoft.io/nuget/v3/index.json

Result: succeeded and created the 5.7.2 packages.

Resolved dependency:

Microsoft.Rest.ClientRuntime 2.3.24

The generated Microsoft.IdentityModel.KeyVaultExtensions.5.7.2.nupkg declares Microsoft.Rest.ClientRuntime 2.3.24 for its target frameworks.

Affected tests:

Project	Frameworks	Result
Microsoft.IdentityModel.KeyVaultExtensions.Tests	net452, net461, net10.0	54 passed
Microsoft.IdentityModel.ManagedKeyVaultSecurityKey.Tests	net452, net461, net10.0	30 passed

Fixes the NU1902 failure caused by GHSA-whph-446h-6m9v.

[saurabhsathe-ms]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.