[repo-assist] Fix credential lookup for www.nuget.org / nuget.org mismatch (fixes #3843)

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Closes #3843

Root cause

paket config add-token 'https://www.nuget.org' <token> (the exact example shown in docs/content/commands/config.md) stores the token under the source https://www.nuget.org.

paket push without an explicit --url looks up credentials using the default source https://nuget.org (no www) — see PublicAPI.fs (Dependencies.Push).

ConfigFile.getSourceNodes only matched sources with an exact string comparison (after trimming a trailing slash), so a token stored under https://www.nuget.org was never found when looking up https://nuget.org. Push then fell through to requiring an explicit API key and failed with a confusing 403 error, exactly matching the symptom reported in #3843.

Fix

getSourceNodes now also normalizes away a www. host prefix when comparing the stored source attribute to the requested source, so https://nuget.org and https://www.nuget.org (and (redacted) variants) are treated as equivalent for credential lookup purposes only. The actual URL used for requests is unchanged — this only affects the config-file source-matching logic in src/Paket.Core/Versioning/ConfigFile.fs`.

Trade-offs

• This is a general www. prefix normalization (not nuget.org-specific), matching the existing trailing-slash normalization already present in getSourceNodes. It's scoped to the credential source-matching comparison only, so it can't change what host/URL is actually contacted.
• Considered instead reusing NetUtils.normalizeFeedUrl (used for package-source/feed matching), but that function's scope and equivalence list is feed-specific; a minimal, local www. normalization directly in ConfigFile.fs is more surgical and keeps the change isolated to the credential-lookup path.

Test Status

• dotnet build src/Paket.Core/Paket.Core.fsproj -f netstandard2.0 — succeeded (0 errors, pre-existing warnings only).
• dotnet test tests/Paket.Tests/Paket.Tests.fsproj -f net10.0 --filter "FullyQualifiedName~ConfigFileSpecs|FullyQualifiedName~RemotePushUrl" — 12 passed, 0 failed, 2 skipped (skipped tests are pre-existing Windows-only crypto tests, not related to this change).
• Added a new regression test get source nodes ignores www prefix mismatch for nuget.org in tests/Paket.Tests/Versioning/ConfigFileSpecs.fs that verifies a token stored for https://www.nuget.org is found via https://nuget.org and vice versa.

Generated by 🌈 Repo Assist, see workflow run. Learn more.
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@ae8d551f07c7ed7619f8c58c7bb4c3ac89395d38