Audit at restore time must not throw and fail the operation

[nkolev92]

Found this in an activity log:

<description>NuGet.Protocol.Core.Types.FatalProtocolException: Unable to load the service index for source https://pkgs.dev.azure.com/<redacted>/_packaging/<redacted>/nuget/v3/index.json. ---> System.Net.Http.HttpRequestException: Response status code does not indicate success: 401 (Unauthorized). at System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode() at NuGet.Protocol.HttpSource.<>c__DisplayClass15_0`1.<<GetAsync>b__0>d.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Common.ConcurrencyUtilities.<ExecuteWithFileLockedAsync>d__5`1.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at NuGet.Common.ConcurrencyUtilities.<ExecuteWithFileLockedAsync>d__5`1.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Protocol.HttpSource.<GetAsync>d__15`1.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at NuGet.Protocol.ServiceIndexResourceV3Provider.<GetServiceIndexResourceV3>d__11.MoveNext() --- End of inner exception stack trace --- at NuGet.Protocol.ServiceIndexResourceV3Provider.<GetServiceIndexResourceV3>d__11.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Protocol.ServiceIndexResourceV3Provider.<TryCreate>d__10.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at NuGet.Protocol.Core.Types.SourceRepository.<GetResourceAsync>d__16`1.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Protocol.Providers.VulnerabilityInfoResourceV3Provider.<TryCreate>d__1.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at NuGet.Protocol.Core.Types.SourceRepository.<GetResourceAsync>d__16`1.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Commands.VulnerabilityInformationProvider.<GetVulnerabilityInfoAsync>d__5.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Commands.VulnerabilityInformationProvider.<GetVulnerabilityInformationAsync>d__4.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Commands.Restore.Utility.AuditUtility.<GetAllVulnerabilityDataAsync>d__83.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Commands.Restore.Utility.AuditUtility.<CheckPackageVulnerabilitiesAsync>d__77.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Commands.RestoreCommand.<PerformAuditAsync>d__69.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Commands.RestoreCommand.<ExecuteAsync>d__68.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Commands.RestoreRunner.<ExecuteAsync>d__7.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.Commands.RestoreRunner.<ExecuteAndCommitAsync>d__6.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at NuGet.SolutionRestoreManager.RestoreOperationLogger.<RunWithProgressAsync>d__35.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.SolutionRestoreManager.SolutionRestoreJob.<RestorePackageSpecProjectsAsync>d__26.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.SolutionRestoreManager.SolutionRestoreJob.<RestoreAsync>d__24.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at NuGet.SolutionRestoreManager.SolutionRestoreJob.<RestoreAsync>d__24.MoveNext() --- 
End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at NuGet.SolutionRestoreManager.SolutionRestoreJob.<ExecuteAsync>d__23.MoveNext()</description>

If you follow the stack trace, you'll see that the throw is happening in restore command project level and throwing all the way to the solution restore job.

I think the original idea behind this was a warning NU1900, https://learn.microsoft.com/en-us/nuget/reference/errors-and-warnings/nu1900, but we should consider whether need to differentiate between a source being inaccessible altogether and a source not supporting vulnerabilities.

IMO, we should not log a warning if we can't access the feed altogether, as that'd be surfaced by other means potentially, but that would break some scenarios, so maybe we log a min message instead in that case?
We should log an NU1900 warning if the source has vulnerabilities and they're broken for any reason.

cc @zivkan thoughts?

[nkolev92]

Note that this should probably lead to some changes in the solution restore job as well, since it shouldn't throw and write in the acitvity log. There's a chance that it didn't throw but just wrote to the acitvity log, but the idea stands that the whole stack needs to be more resilient.