.NET: Add tenant-scoped task store isolation for A2A hosting

[SergeyMenshykh]

Motivation & Context

The A2A hosting layer applies multi-tenant isolation to the session store but not the task store. This PR extends isolation to cover task operations as well.

Description & Review Guide

• What are the major changes?

  • New IsolationKeyScopedTaskStore class that wraps ITaskStore with per-tenant key scoping (mirrors IsolationKeyScopedAgentSessionStore).
  • CreateA2AServer automatically wraps the task store when a SessionIsolationKeyProvider is registered.
  • Updated XML doc trust-model remarks to cover both stores.
  • Updated sample comments to reflect the broader isolation scope.

• What is the impact of these changes?
  Task operations are now scoped per tenant in multi-user deployments. No behavioral change for single-user/prototyping scenarios.

• What do you want reviewers to focus on?
  Correctness of the ListTasksAsync ContextId scoping/unscoping logic and the clone-vs-mutate approach.

Related Issue

Fixes microsoft#7431

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.