[Feature Request] Pin native NuGet package hashes for Rust HTTP mode

### Describe the feature request

Add optional in-repository SHA-512 pins for the Rust SDK's native NuGet dependencies and verify HTTP-mode downloads against those trusted digests before extraction. The digests should be committed alongside the package version pins rather than read from the same feed that serves the package.

This follows the integrity review of #1049. Feed-published hashes detect corruption but do not protect against a compromised feed because the artifact and hash share the same trust root. Mandatory NuGet signature enforcement may also be incompatible with the existing ORT-Nightly Azure Artifacts feed, so independent pinned hashes are the narrower hardening mechanism.

### Describe scenario use case

A high-assurance or locked-down build uses the Rust SDK's dependency-free `http` acquisition mode. Before staging native libraries that will execute in-process, the build script verifies each `.nupkg` against a repository-controlled digest and fails on a mismatch. `dotnet` and `nuget` modes continue delegating integrity policy to standard NuGet tooling.

### Customer requirement and impact

This provides defense in depth against compromised or incorrectly configured package feeds for customers that cannot use the .NET or standalone NuGet tooling paths. It is separate from #1049, which fixes honoring configured mirrors and `NuGet.Config`; the existing HTTP trust model predates that change.

Start at the Rust SDK's dependency-free HTTP acquisition path and the existing native NuGet version pins. Trace how .nupkg files are downloaded and staged, then inspect any related acquisition tests. Done means repository-controlled SHA-512 pins are checked before extraction in HTTP mode, while dotnet and nuget modes retain their existing behavior.

Written by the indexing model from the issue text.