NuGetAudit should check direct PackageReferences by default

[zivkan]

NuGet Product(s) Affected

NuGet.exe, MSBuild.exe, dotnet.exe

Current Behavior

NuGetAudit, that first became available in .NET 8 preview 5, checks all (direct and transitive) packages for known vulnerabilities.

Desired Behavior

Add a new MSBuild property <NuGetAuditMode> with allowed values direct and transitive.

• Direct

Check packages that are directly referenced by the project. This includes not only <PackageReference items in the project file, but any <PackageReference that might be in a Directory.Build.props, or even any "implicit" packages that SDKs and project systems add. Finally, the way that Central Package Management's transitive pinning works is by elevating any transitive package to a direct reference when a pinned version is avaiable, and as a consequence these packages will also be checked for known vulnerabilities.

• Transitive

All NuGet packages in the project's restore graph will be checked for known vulnerabilities, whether those packages are directly referenced by the project, or are transitive packages (dependencies of another package).

Example:

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>net7.0</TargetFramework>
    <NuGetAudit>true</NuGetAudit>
    <NuGetAuditMode>transitive</NuGetAuditMode>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="NuGet.Protocol" Version="5.11.3" />
  </ItemGroup>
</Project>

Additional Context

No response