Backport NuGet.Client patch to pin package versions

[MichaelSimons]

Patch: https://github.com/dotnet/installer/blob/main/src/SourceBuild/tarball/patches/nuget-client/0001-Pin-Microsoft.Build-and-Microsoft.Extensions.Command.patch

This patch was needed so that NuGet.Client isn't built with the latest versions of these packages that can contain API breaks. The additional benefit is that the way source-build builds the product is closer to the way the product builds the product.

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.