Wire vendored nuget.config through formats::nuget (#594) (#1288)

* Start refactor for #594

Assisted-by: Claude Code:claude-opus-5-5

* Wire vendored nuget.config via formats::nuget

Vendored NuGet now reads the source keys and finds the
<packageSources>, <packageSourceMapping> and <configuration> anchors
through formats::nuget::parse_config, the reader that hosted,
upstream restore and VEX already use. The private substring scanner
(blank_comments, parse_config_source_keys, attr_value,
self_closing_package_sources, insert_at_line) is deleted.

User impact:
- A close tag written with whitespace (</packageSources >) is now the
  section that gets extended; vendor used to append a second section
  NuGet ignores, so restore failed NU1100/NU1403 (#685).
- An empty <packageSourceMapping /> is expanded in place instead of
  left beside a second mapping section.
- A section opened and closed on one line receives the source inside
  it, not before its open tag.
- Catch-all keys are written XML-encoded, so a key with & or a quote
  keeps its identity.
- Malformed XML or a repeated section is refused with "malformed XML
  or a repeated section; not wired" instead of being spliced at the
  first substring match, as hosted already does.

Output bytes for well-formed configs are unchanged.

Fixes #685
Refs #594

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-core/src/formats/nuget/mod.rs

@@ -291,6 +291,20 @@ fn decode_entities(raw: &str) -> String {
     out
 }
 
+/// Encode `value` for a double-quoted attribute: the inverse of
+/// [`parse_config`]'s decoding, so a key read as `a&b` is written back as
+/// `a&b` and keeps its identity.
+pub(crate) fn xml_attribute(value: &str) -> String {
+    value
+        .replace('&', "&")
+        .replace('"', """)
+        .replace('<', "&lt;")
+        // Literal XML attribute whitespace would be normalized to spaces.
+        .replace('\t', "&#x9;")
+        .replace('\n', "&#xA;")
+        .replace('\r', "&#xD;")
+}
+
 #[cfg(test)]
 mod tests {
     #[test]