The dotnet tool install path, as it gets installed for the Azure DevOps environment, is not included in the lockfile generation sandbox for allowed paths. It should be. It may not be a fixed path but might be available via an environment variable. See the full discussion on this (internal) Slack thread.