Add .NET NuGet ecosystem support

[bjcorder]

Problem

The scanner does not currently inspect .NET dependency declarations. NuGet projects can drift through floating PackageReference versions, missing packages.lock.json, central package management ranges, and legacy packages.config constraints.

Current supported ecosystems cover Node, Python, Go, Rust, JVM, Ruby, Terraform/OpenTofu, containers, and GitHub Actions, but not .NET/NuGet.

Proposed behavior

Add conservative static NuGet support for common .NET dependency files.

Suggested rule shape:

• Ecosystem: dotnet or nuget.
• Include files such as *.csproj, *.fsproj, *.vbproj, Directory.Packages.props, packages.config, and packages.lock.json where needed.
• Flag floating or ranged package versions in PackageReference, central PackageVersion, and legacy packages.config declarations.
• Require packages.lock.json for project/package declarations when restorePackagesWithLockFile style lockfile policy is in scope.
• Treat exact NuGet versions as deterministic when lockfile policy is disabled or otherwise satisfied.
• Ignore XML comments and unrelated properties.

Acceptance criteria

• Default discovery includes the relevant .NET/NuGet declaration files.
• The scanner reports findings for floating/ranged NuGet dependency versions such as *, 1.*, [1.0,), or equivalent non-exact constraints.
• The scanner reports a lockfile-required finding for projects with package dependencies when packages.lock.json is missing, if that default policy is enabled.
• The scanner does not report for exact versions with lockfile coverage or for comments/unrelated XML.
• Fixtures are added under __tests__/fixtures/dotnet/ or __tests__/fixtures/nuget/.
• docs/rules.md, docs/ecosystems.md, docs/configuration.md, README supported ecosystems, and the config schema are updated as needed.
• If runtime behavior changes, run npm run bundle and commit the updated dist/ output.