Add a 'no-network-access' mode/flag to CLI command invocation

### Is your feature request related to a problem? Please describe.

Today we support an 'offline' style of building if a user follows a few practices:
* separate `restore`
* declare all of your RIDs and publish modalities
* use `--no-restore` on subsequent build/test/publish/pack invocations

However, this doesn't impact the behavior of the dotnet CLI itself - meaning the parts of the code that aren't hosted inside the MSBuild invocation. This includes things like

* telemetry egress
* workload manifest daily check
* etc

While each of these mechanisms has disablement flags, users need a single knob they can use to control all of the network communications that the CLI drives.

### Describe the solution you'd like

We should create and document a new flag/config that will be used as a default value for all of our existing workflows that call external resources.

This new flag should be settable via
* environment variable
* a CLI option (flag) that is available to every command, much like the `--debug` flag today is
* the env var processing should be handled as part of the default value computation of the option

This flag should be taken into account by all of our components that do network communication.

### Additional context

Note that this will not impact the behavior of external MSBuild logic/Tasks - these can still run arbitrary code that the CLI will not know about. It also will not apply to any dotnet tools that are run via `dotnet ` - such tools likely will not know about the option at all.