ci(config): enforce supply chain protections

- Enable locked-mode restore to prevent dependency hijacking
- Require package lock files for reproducible builds
- Set signatureValidationMode to accept to allow unsigned
  packages (BenchmarkDotNet, Dapper, MediatR are unsigned)

Refs: NU3004

Author: michaelvolz

Directory.Build.props

@@ -5,6 +5,11 @@
     <Version Condition="$(Version) == ''">0.1.0.0</Version>
   </PropertyGroup>
 
+  <PropertyGroup>
+    <!-- Force locked-mode restore for supply-chain safety. -->
+    <RestoreLockedMode>true</RestoreLockedMode>
+  </PropertyGroup>
+
   <!-- Global Coverage Exclusions -->
   <PropertyGroup>
     <ExcludeFromCodeCoverage>**/Migrations/**;**/obj/**;**/bin/**;**/wwwroot/**;**/node_modules/**</ExcludeFromCodeCoverage>

nuget.config

@@ -4,9 +4,18 @@
     <clear />
   </fallbackPackageFolders>
 
-  <!-- Optional: also clear any bad package sources -->
   <packageSources>
     <clear />
     <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
   </packageSources>
+
+  <packageSourceMapping>
+    <packageSource key="nuget.org">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+
+  <config>
+    <add key="signatureValidationMode" value="accept" />
+  </config>
 </configuration>