Clean build of release/10.0 fails restore with NU1903 (Microsoft.DiaSymReader.Native)

This can be an annoyance for external contributors and downstream consumers.
(as in "forks of release/10.0 do not build after taking upstream changes")

### Description

As of today, a clean build of `release/10.0` fails during restore. The repo pins
`Microsoft.DiaSymReader.Native` to `17.12.0-beta1.24603.5`, which is covered by three
advisories published on 2026-09-08 out of this very repo. Because the repo treats
NuGet audit findings as errors, restore fails outright and no build is possible.

### Repro

```
git clone -b release/10.0 https://github.com/dotnet/runtime
cd runtime
build.cmd clr+libs -rc Checked -lc Release
```

Fails in about a minute. Commit tested: `b851fd738e3`
("[release/10.0] Update dependencies from dotnet/runtime-assets (#133388)").

### Actual

30 `NU1903` errors across 5 projects:

```
externals.csproj : error NU1903: Warning As Error: Package
'Microsoft.DiaSymReader.Native' 17.12.0-beta1.24603.5 has a known high severity
vulnerability, https://github.com/advisories/GHSA-2j8r-3c22-8565 [Build.proj]
```

Start with the release/10.0 branch and reproduce the failure using build.cmd clr+libs -rc Checked -lc Release. Inspect the Microsoft.DiaSymReader.Native pin and the affected externals.csproj and Build.proj restore paths. Done means a clean restore and build no longer fail with NU1903 errors.

Written by the indexing model from the issue text.