Only list supported RIDs for ILCompiler (#16545)

Attempting to publish AOT on an unsupported host, or with an
unsupported target RID, will produce an error in the SDK before trying
to restore the ILCompiler packages. This uses the RID list in
`KnownILCompilerPack` as the source of truth for what is considered
supported. Then with improved error reporting
(dotnet/sdk#32943), this will give enough info
to the user about why a scenario isn't supported for aot.

Failing before restore does mean that advanced users who want to test
with unsupported ILC packages need to use a different
workaround. Instead of adding a `PackageReference`, they'll need
something like this:

```xml
<ItemGroup>
  <KnownILCompilerPack Update="@(KnownILCompilerPack)">
    <ILCompilerRuntimeIdentifiers>unsupported-rid</ILCompilerRuntimeIdentifiers>
  </KnownILCompilerPack>
</ItemGroup>
```

src/redist/targets/GenerateBundledVersions.targets

@@ -284,12 +284,22 @@
 
       <Crossgen2SupportedRids Remove="win-arm" />
 
-      <!-- Match the Crossgen2 RIDs although some are currently not supported in NativeAOT. Its better for the SDK not to block on the RIDs and let NativeAOT manage the experience -->
-      <Net70ILCompilerSupportedRids Include="@(Net60Crossgen2SupportedRids)" />
-
-      <ILCompilerSupportedRids Include="@(Net70ILCompilerSupportedRids)" />
+      <Net70ILCompilerSupportedRids Include="
+        linux-arm64;
+        linux-musl-arm64;
+        linux-musl-x64;
+        linux-x64;
+        win-arm64;
+        win-x64;
+        " />
 
-      <ILCompilerSupportedRids Remove="win-arm" />
+      <!-- The subset of ILCompiler target RIDs that are officially supported. Should be a subset of
+           https://github.com/dotnet/runtime/blob/main/src/installer/pkg/projects/Microsoft.DotNet.ILCompiler/ILCompilerRIDs.props -->
+      <ILCompilerSupportedRids Include="
+        @(Net70ILCompilerSupportedRids);
+        osx-x64;
+        osx-arm64;
+        " />
 
       <NativeAOTRuntimePackRids Include="
           ios-arm64;