[Bug] SourceLink is not enabled on NuGet packages

[filzrev]

Describe the bug
Source Link is not enabled on published NuGet packages.

To Reproduce

1. Open Microsoft.DocAsCode.App NuGet package page
2. Select specific version. then click Open in NuGet Package Explorer link on side menu.
3. Following health checks failed.

• Source Link: Missing Symbols
• Deterministic (dll/exe): Non deterministic
• Compiler Flags: Missing

Expected behavior
Pass above health checks.

Context (please complete the following information):

• Docfx version: All package versions published on NuGet.

Additional context
It seems there is no problems on NuGet artifacts created by GitHub Actions. (confirmed by NuGet Package Explorer)
https://github.com/dotnet/docfx/actions/runs/5330807012

So this issue caused by *.snupkg symbols is not published to NuGet.
If *snupkg is published. NuGet package page have Download symbols link,

[yufeih]

Plan to fix it as part of #8930 where it adjusts the NuGet sign and publish pipeline.

[filzrev]

I've confirmed 2.7.0.0 package's that are created by CI.
https://github.com/dotnet/docfx/actions/runs/5538868981

Latest packages use .NET Foundation's certificate and signed with dotnet/sign tool.
In this case, NuGet Package Explorer will fail to validate certificate on some specific environment (when using .NET SDK 6.0.300.xxx)

Because dotnet/sign tool's default timestamp server (http://timestamp.acs.microsoft.com) is not trusted on older version of .NET SDK 6 (6.0.300.xxx).

These problems are reported & discussed at following repositories.

• https://github.com/dotnet/sdk/issues/33928
• https://github.com/dotnet/sign/issues/638

For temporary workaround. It need to add following argument to sign tool.

--timestamp-url http://timestamp.digicert.com

xUnit v2.5.1 seems to using this temporary workaround.
xunit/xunit@3d9ab61#diff-5f3a0255c3c91683858126f61079c6ad62b6f762fb008215404d67203a171f13

[yufeih]

Aha. Thanks for checking!