Support resolving endpoints using known network ids in deployment

We added a NetworkIdentifier concept to endpoints which makes it possible to change how endpoints are resolved in different contexts. Today we're only taking advantage of this in run mode but we can use it in publish mode when we are deploying to signal how to resolve endpoints:

e.g.

The thing that stops [this](https://github.com/dotnet/eShop/blob/1b2698cd83ed5c9e00a2fa954f2586c87022c431/src/eShop.AppHost/Program.cs#L95-L99) from working in docker compose is the fact that is the fact that these endpoints need to be resolved in the context of the public internal / browser.

When using keycloack / entra any auth server or any time you need to be explicit about what context an endpoint gets resolved, we need to support this.

Start with the eShop.AppHost/Program.cs example at lines 95-99 and trace how endpoints are resolved during deployment to Docker Compose. Compare publish-mode behavior with the existing run-mode use of NetworkIdentifier. Done means known network IDs can select the correct public, internal, or browser endpoint context during publish, including authentication scenarios.

Written by the indexing model from the issue text.