[source-build] Poison check should scan all shipping packages

[NikolaMilosavljevic]

It appears that NuGet packages are not being scanned for poison - the following line will not include any packages: https://github.com/dotnet/sdk/blob/50702508f006c8c0b362493bd1a8b945845b06e4/src/SourceBuild/content/eng/finish-source-only.proj#L134-L135

      <!-- Include shipping nuget packages. -->
      <PoisonFileToCheck Include="$(ArtifactsShippingPackagesDir)*.nupkg" />

This was likely caused by distributed/parallelized build refactoring that moved packages to repo sub-directories.

Tasks:

• Fix this issue in main
• Ensure 9.0 is correct
• Harden the infra to prevent this regression in the future

[NikolaMilosavljevic]

No poison issues were found in main or 9.0.