NSF has an official FAQ for their proposal guide. One of the entries in the FAQ is applicable here.
Instructions for the Biographical Sketch Products section indicate that “acceptable
products must be citable and accessible.” Accessibility may be difficult to
accomplish in the case of manuscripts submitted or accepted for publication and
other documents and materials. Access may need to be provided through
organizational or personal websites. Will that be sufficient to meet the proposal
submission requirements?
The requirement that all products be "citable and accessible" is not a submission
requirement, in the sense of blocking a proposal from consideration, but a definition of the
standard to which proposers should adhere. PAPPG Chapter II.C.2.f(i)(c) also notes that
full citation information should be included where applicable and practicable. References
to organizational or other websites are allowable, provided that the site is available for a
reasonable percentage of the time.
From this statement, it is clear that NSF would consider a preprint server to be a reasonable place for a work product to be located. In fact, the key consideration seems to not be citation per se (you can cite pretty much anything), but simply having a clearly defined "thing" that is readily accessible for the review committee to inspect.
Given this statement and the confidentiality of peer review processes, it is next important to observe that there is no way for a proposal reviewer to distinguish between:
- A preprint that has been submitted
- A preprint that has not been submitted
- A preprint that was submitted at the time when the proposal was written, then rejected before the proposal came up for review.
Between this and the shift to a general definition of "work product" it is clear that NSF is trying to give as much latitude as possible for the review committee to say "this person is doing interesting work, let's give them a fellowship." It would make no sense for a committee to be allowed to consider a non-peer-reviewed software repository on GitHub but not a non-peer-reviewed preprint on arXiv.
Bottom line: material on preprint servers is fine to include in an NSF biosketch.