Backport CFS cargo registry config to hotfix/keyvault CI

[ROHIT SINGHAL (rohitsinghal4u)]

Why

The keyvault 1.0.1 hotfix release pipeline (internal rust - keyvault, build 6744430) on hotfix/keyvault fails every cargo step — not because of the security fix, but because this branch was cut from the azure_security_keyvault_keys@1.0.0 release tag, which predates the repo's migration to the private crates.io mirror (Azure Artifacts feed, #5033).

Under 1ES NetworkIsolation there is no public crates.io egress, so cargo cannot reach index.crates.io:443:

Stage → task	Command	Error
Pack Crates → Check SemVer compatibility	cargo install cargo-semver-checks	connect to index.crates.io failed
Analyze → Run source analysis	cargo install cargo-deny	connect to index.crates.io failed
Test → Test Packages (stable/msrv/nightly × win/ubuntu)	cargo build --all-features	unable to update registry crates-io

What

Backport the eng-only registry plumbing from main so the pipeline routes cargo traffic through the azure-sdk-for-rust feed:

• add eng/templates/config.toml.template — replaces crates.io with the sparse Azure Artifacts feed, and sets it as the default registry so Pack-Crates.ps1 needs no CI-only --registry flags.
• eng/pipelines/templates/steps/use-rust.yml — before rustup, write that config to \/config.toml (falls back to ~/.cargo on this branch, where CARGO_HOME isn't relocated) and run NuGetAuthenticate@1 + CargoAuthenticate@0. Guarded by a new ConfigureRegistry parameter (default true), matching main.

use-rust.yml is the shared toolchain step in every cargo job (pack / analyze / tests / release), so this one injection point fixes all failing steps.

Scope / safety

• No product code changes — the 1.0.1 challenge-cache security fix (Hotfix: cache Key Vault challenge scope only after validation (1.0.1) #5125) is untouched. Only eng/ CI config.
• Faithful subset of main's CFS setup (Migrate CFS feed to public feed #5033); keeps the branch's existing inline rustup logic rather than pulling in the Use-Rust.ps1 refactor, to minimize blast radius.
• Pack-Crates.ps1 (cargo package / cargo publish --dry-run with no --registry) and Test-Semver.ps1 need no changes — the [registry] default + mirror handle them.

After merge, re-queue rust - keyvault against hotfix/keyvault to publish 1.0.1.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
3 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Heath Stewart (heaths)]

I've already checked out eng/ from the main branch in the hotfix/keyvault branch.