Normalize package source names when resolving environment variable credentials

[Foitn]

Bug

Fixes: NuGet/Home#14562

Description

This PR fixes a bug where environment variable credential lookup fails if the package source key in nuget.config contains characters that are invalid in environment variable names (such as -, space, @, etc.).

Currently, only . is normalized to _ when constructing the environment variable name, but other invalid characters are not handled. For example:

• Source key: foo-bar
• Expected env vars: NuGetPackageSourceCredentials_foo_bar_Username, NuGetPackageSourceCredentials_foo_bar_ClearTextPassword
• Actual lookup: NuGetPackageSourceCredentials_foo-bar_Username (invalid, cannot be set as an environment variable)

This PR adds normalization logic so that all non-alphanumeric characters are replaced with _ before environment variable lookup.

Example behavior

Source key	Old lookup name	New lookup name
foo.bar	NuGetPackageSourceCredentials_foo_bar_*	NuGetPackageSourceCredentials_foo_bar_* (unchanged)
foo-bar	NuGetPackageSourceCredentials_foo-bar_* (invalid)	NuGetPackageSourceCredentials_foo_bar_*
my source!	NuGetPackageSourceCredentials_my source!* (invalid)	NuGetPackageSourceCredentials_my_source_*

This change aligns behavior with the documentation and makes environment variable credentials usable with any source name.

PR Checklist

• [ x] Meaningful title, helpful description and a linked NuGet/Home issue
• [x ] Added tests
• [x ] Link to an issue or pull request to update docs if this PR changes settings, environment variables, new feature, etc.

[Foitn]

@dotnet-policy-service agree

[martinrrm]

this change is affecting two existing tests:

NuGet.Client/test/NuGet.Core.Tests/NuGet.Configuration.Test/SettingsTests.cs

Line 2109 in 3ca8733

public void NuGetEnviromentPath_OnWindows_ReturnsCorrectPath()

and

https://github.com/NuGet/NuGet.Client/pull/6808/files#diff-2fca7fef8d0694494faad14f1088a0ee2a58cadd350f58a28ded8dfdb4369931R31

I believe this is a breaking change that we need to talk more about

[zivkan]

This excludes a whole lot of allowed environment variable characters, basically all valid characters that are not English language letters. I tried both accented latin characters, as well as one non-latin character, and at least on Windows there's no problems using them as environment variables.

[Foitn]

Well we could also use a filter the other way around, so lets say that all characters that match "#@%!-*" etc, are replaced as '_'
That would at least solve the issue with allowed environment variable characters that are currently not in this set and it would solve the linked issue

[dotnet-policy-service]

This PR has been automatically marked as stale because it has no activity for 7 days. It will be closed if no further activity occurs within another 30 days of this comment. If it is closed, you may reopen it anytime when you're ready again, as long as you don't delete the branch.