WIP: add NuGet vulnerability information to BOMs

[mtsfoni]

Current state

This WIP implements the core NuGet-vulnerability ingestion path for Issue #805.

• Queries IVulnerabilityInfoResource once per BOM generation.
• Matches returned NuGet package/version ranges against resolved components.
• Emits matching records in the CycloneDX vulnerabilities section, including advisory URL, inferred advisory ID, severity, and affected BOM reference.
• Treats unavailable vulnerability resources and retrieval errors as non-fatal; generation continues with no vulnerability entries.
• Adds unit coverage for shard merging, range matching, severity mapping, advisory IDs, unsupported feeds, and retrieval failures.

Validation

• dotnet test CycloneDX.Tests --framework net10.0 --no-restore
  • 235 passed, 2 skipped

Remaining work / decisions

• Decide whether vulnerability lookup should be opt-in or have a CLI switch to disable it. The current implementation performs the feed lookup for every BOM generation.
• Review CycloneDX vulnerability-field modeling and NuGet version-range conversion. The current range is emitted as NuGet ToShortString() output, which is not yet converted to a vers: URI.
• Add end-to-end coverage using a controlled NuGet vulnerability feed or fixture.
• Review warning behavior for offline/private feeds and whether failures should be logged at all.

Not ready to merge.