Enable AOT-compiled SDK tools in source-build - #7300

The SDK bundles three ASP.NET Core CLI tools (dotnet-dev-certs, dotnet-user-jwts,
dotnet-user-secrets) as a Native AOT aggregate, but AOT publishing of these tools
only worked in the Microsoft build. In source-build it failed in two ways: restore
could not find a portable-RID runtime pack (NU1102), and once scoped to the build's
non-portable RID the previous SDK rejected the project with NETSDK1203 ("Ahead-of-time
compilation is not supported for the target runtime identifier"). The root cause is
that every repo in the VMR builds against a previous SDK; in a stage 1 source-build
leg that SDK is the Microsoft portable SDK, whose bundled props do not list the build's
non-portable RID (e.g. centos.10-x64) in the ILCompiler/runtime-pack RID sets and whose
packs/ folder has no NativeAOT pack for that RID.

Teach the previous SDK about the source-built non-portable RID and unblock AOT publishing,
then ship the resulting aggregate in source-build. Fixes dotnet/source-build#5567.

Arcade SDK:
- TargetingPacks.BeforeCommonTargets.targets: in source-build, append the build's
  non-portable RID to the in-memory KnownILCompilerPack ILCompilerRuntimeIdentifiers
  (new), alongside the existing KnownRuntimePack and KnownCrossgen2Pack RID sets. Switch
  the appended value from $(NETCoreSdkRuntimeIdentifier) to $(TargetRid): in a stage 1 leg
  the bootstrap SDK is portable, so $(NETCoreSdkRuntimeIdentifier) is the portable RID and
  would not unblock publishing for the build's non-portable target RID.
- ProjectDefaults.targets: for source-build projects that publish with Native AOT, set
  StripSymbols=false so the produced binary keeps embedded DWARF (no separate symbol file
  or .gnu_debuglink). This is the AOT analog of source-build's KeepNativeSymbols=true and
  satisfies the source-build native-symbol validation. Scoped to PublishAot so non-AOT
  builds are unaffected, and gated on DotNetBuildSourceOnly so Microsoft builds still strip.
  Placed in .targets (imported after the project sets PublishAot) so the condition is known.

runtime:
- Microsoft.DotNet.ILCompiler.SingleEntry.targets: when source-build publishes for the
  non-portable target RID against a portable bootstrap SDK, the target OS derived from the
  RID (e.g. "centos") is not a valid ILC target OS. Map it to the portable base OS (e.g.
  "linux"), mirroring the existing non-portable SDK RID handling, without changing the
  host/target pack names the SDK already resolved.

aspnetcore:
- Remove the DotNetBuildSourceOnly != 'true' gates that disabled PublishAot for the three
  leaf tool projects and the aspnetcoretools aggregate, and include the aggregate in the
  source-build project set (eng/Build.props). Simplify the aggregate's RuntimeIdentifier(s)
  selection now that AOT runs in source-build too.

sdk:
- BundledDotnetTools.targets: bundle the Native AOT aspnetcoretools aggregate in source-build
  instead of the per-tool managed IL packages. Remove the three source-build-only per-tool
  entries and un-gate the RID-specific tool selection so the aggregate's non-portable RID
  package (e.g. aspnetcoretools.centos.10-x64) is selected.

Co-authored-by: Copilot <[email protected]>

Addresses review feedback: the previous fix placed VMR-specific properties (DotNetBuildSourceOnly/TargetRid) in Microsoft.DotNet.ILCompiler.SingleEntry.targets, which ships in the ILCompiler NuGet package and runs on end-user builds.

Replace that with a general ILC robustness fix using only ILC-intrinsic signals: when the target OS token derived from the RuntimeIdentifier is version-qualified (contains '.', e.g. 'centos.10' from 'centos.10-x64') and the RID is not the running SDK's own non-portable RID, map it to the SDK-reported portable base OS (e.g. 'linux'). Valid base OS tokens never contain a '.', so this reliably identifies a non-portable target RID published against a portable SDK. The SDK still resolves the host/target packs by full RID; only the ILC target OS needs normalizing.

Co-authored-by: Copilot <[email protected]>

Address PR review feedback on the Native AOT StripSymbols override in
ProjectDefaults.targets:

- Derive StripSymbols from the KeepNativeSymbols property instead of
  re-deriving the source-build policy from DotNetBuildSourceOnly, so a
  single overridable property controls native-symbol stripping.
- Default KeepNativeSymbols to true for source-build here so it is in
  scope for repos (e.g. aspnetcore) that publish AOT SDK tools; it is
  otherwise only defaulted within the runtime build.
- Drop the PublishAot scoping; StripSymbols is inert for non-AOT
  projects, so setting it unconditionally is harmless.
- Correct the comment: shipping native binaries have their symbols
  stripped and archived by the distro packaging process, not shipped
  with embedded symbols; remove the issue link.

Co-authored-by: Copilot <[email protected]>