Improve resiliency of Tag & Scan stage

Follow up on https://github.com/dotnet/source-build/issues/5408

When we moved to `1es-unbuntu-2204` agent, the stage got broken, due to inability to run .NET from the expected local path. This issue was fixed with https://github.com/dotnet/sdk/pull/51725

The root cause was a change in agent environment from the one we used previously. With new agent, we have .NET installed in the shared location. This is one example of the environment change, there could be many others.

One way to solve this, is to use a container.

The fix should be implemented in main and backported to 10, at least. A change from https://github.com/dotnet/sdk/pull/51725 should also be incorporated.