dotnet restore fails in locked mode in docker due to Microsoft.AspNetCore.App.Internal.Assets

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

## Context

I ran into this after recently upgrading our app from `net9.0` to `net10.0`. My Blazor Web App project is built regularly in 3 places:

* My dev machine, windows 11
* Directly on an `ubuntu-24.04` AzDO runner
* Inside `mcr.microsoft.com/dotnet/sdk:10.0-noble` on that same AzDO runner

I use `dotnet restore` in locked-mode with a shared `packages.lock.json` committed in my repo:

Details about locked-mode setup

`Directory.Build.props`:

```xml


true

true
```

`azure.pipelines.yml`:

```yml
- script: dotnet restore "$(solution)" /p:ContinuousIntegrationBuild=true
displayName: dotnet restore
```

## Issue

After the upgrade from `net9.0` -> `net10.0`, this locked-mode restore in my docker build fails

```Dockerfile
RUN dotnet restore "src/Contoso.Web/Contoso.Web.csproj" /p:ContinuousIntegrationBuild=true
```

fails with _The packages lock file is inconsistent with the project dependencies so restore can't be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file._

Using the same `packages.lock.json` file, restore works on my dev machine and directly on the `ubuntu-24.04` AzDO runner. Thus, I changed my Dockerfile, added `--force-evaluate` and extracted the resulting file. Diff is:

```diff
- "Microsoft.AspNetCore.App.Internal.Assets": {
- "type": "Direct",
- "requested": "[10.0.1, )",
- "resolved": "10.0.1",
- "contentHash": "rafnWkNfJPA0nCZ5u9bFLiIhCv+aGDWBPJMejuROFMHEpsNhTdv8Cvhv+2jIH+b5485FhndbiwOQJUBMeBa6BQ=="
- },
```

Possibly related: https://github.com/dotnet/sdk/issues/39635

### Expected Behavior

The same `packages.lock.json` file should work for my dev box, directly on the AzDO runner as well as in the container - as it did before `net10.0`.

### Steps To Reproduce

Repro with failing github actions workflow is here:

As described above for AzDO, the build directly on the runner succeeds, but fails inside the container. Thus, the failing actions pipeline is expected as part of the repro.

### Exceptions (if any)

> The packages lock file is inconsistent with the project dependencies so restore can't be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file.

### .NET Version

```log
$ winpty docker run -it --rm mcr.microsoft.com/dotnet/sdk:10.0-noble
root@fe5d7491ed3d:/# dotnet --version
10.0.101
```

### Anything else?

_No response_