docs: recommend pinning SDK version when using NuGet package lock files

[Copilot]

The package lock files docs didn't mention that SDK version pinning is also required for truly reproducible restores—updating the SDK can change the dependency graph and silently invalidate the lock file.

Changes

• docs/core/install/upgrade.md — Package lock files section
  • Adds an [!IMPORTANT] callout recommending a global.json with rollForward: disable alongside lock file usage
  • Includes a minimal JSON example for the recommended config
  • Links back to the existing "Control SDK version with global.json" section on the same page and to the upstream tracking issues (dotnet/aspnetcore#65061, dotnet/sdk#48795)

The global-json.md rollForward table already has a reverse footnote pointing at this section; these two pages now cross-reference each other symmetrically.

Recommended config when using lock files:

{
  "sdk": {
    "version": "9.0.100",
    "rollForward": "disable"
  }
}

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.