Add a utility for checking vulnerabilities during packages.config restore

[nkolev92]

Bug

Fixes: NuGet/Home#12852

Regression? Last working version:

Description

This PR adds the core code for adding vulnerability checking for package.config restore.
This change is just a 1st part of PC vulnerability checking.

This PR mimics some of the work in https://github.com/NuGet/NuGet.Client/blob/dev/src/NuGet.Core/NuGet.Commands/RestoreCommand/Utility/AuditUtility.cs, but it adds more explicit test coverage for the methods.
Note that I did make small changes in the NuGet.Commands code. These changes shorten the code and match the implementation in the PR side.

I didn't want to create a public class as I have no proposal better than a bunch of statics. As we add more scenarios such as vulnerability checking during package installation, we'll be able to create better APIs.

Reasons why this PR doesn't enable the feature.

1. There's no configuration knobs design for packages.config vulnerability. PR is project based so all those things naturally come from there, for packages.config, that's not the case.
2. This would likely cause an immediate RPS regression.

Note

I did test that this API works well and is sufficient for the purposes of packages.config restore vulnerability reporting.

PR Checklist

• PR has a meaningful title

• PR has a linked issue.

• Described changes

• Tests

  • Automated tests added - A lot of tests
  • OR
  • Test exception
  • OR
  • N/A

• Documentation

  • Documentation PR or issue filled
  • OR
  • N/A - Not yet. A different PR that enables the feature will create the docs issues.