Use App Data Microsoft.DotNet.Sdk.Root for resolving SDK root

[Nigusu-Allehu]

Bug

Fixes: NuGet/Home#14980

Description

NuGet.Packaging locates the SDK-provided trusted-root bundles ( trustedroots/codesignctl.pem  and  trustedroots/timestampctl.pem ) via  AppContext.BaseDirectory , assuming it resolves to the versioned SDK directory (e.g.  dotnet/sdk/10.0.301 ).

Under the Native AOT  dotnet  CLI, that assumption breaks:  dotnet-aot.dll  is loaded directly by the muxer so the pem bundles can't be found and signature/timestamp verification could fail.

This adopts the resolution pattern from dotnet/sdk#55110: the AOT entry point publishes the resolved versioned SDK directory as the  Microsoft.DotNet.Sdk.Root  AppContext value.  FallbackCertificateBundleX509ChainFactory  now reads that value first, falling back to  AppContext.BaseDirectory  when it is unset

PR Checklist

• Meaningful title, helpful description and a linked NuGet/Home issue
• Added tests
• Link to an issue or pull request to update docs if this PR changes settings, environment variables, new feature, etc.