Enable NuGet auditing

[meziantou]

NuGet provides a way to report vulnerable packages when restoring packages. This PR enables it by default to ensure developers are aware of vulnerabilities in their projects and fix them.

Why?

Make sure developers are aware of .NET vulnerabilities, and so, increase the chances that they fix them:

• Vulnerabilities are reported in the IDE
• Vulnerabilities are reported in the CI

Considerations

• Only supported by .NET SDK 8.0.100+. Projects still targeting .NET SDK 6 won't get benefit from this change. However, .NET 6 is EOL by the end of the year. So, all projects will soon benefit from this change.
• ADO feeds: If you only use ADO NuGet feeds, currently .NET SDK is not able to fetch known vulnerabilities. This will be fixed in a future version of .NET (already implemented, will be available in the next version). Currently it only seems to be possible to define audit sources in the NuGet.config file. I've opened an issue to ask for an MSBuild configuration. This would allow us to define the audit source in the coding standard too.

What if I cannot fix the warning yet?

You can disable the warning for specific packages using NoWarn on the PackageReference

<PackageReference Include="System.Formats.Asn1" Version="8.0.0" NoWarn="NU1903" />

More resources

• https://www.meziantou.net/enable-nuget-auditing-for-your-dotnet-projects.htm
• https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages?WT.mc_id=DT-MVP-5003978
• https://devblogs.microsoft.com/nuget/announcing-nuget-6-8-maintaining-security-with-ease/?WT.mc_id=DT-MVP-5003978#nugetaudit-notifications-for-package-vulnerabilities

[asimmon]

Can we update the README as well regarding how to disable audit warnings/errors for specific packages?