✨ add support for Nuget ad-hoc commands (add/install) in Pinned Dependency checks

[balteravishay]

What kind of change does this PR introduce?

Add support for Nuget ad-hoc commands (add/install) in pinned dependency checks.

• [v] PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

Scorecard does not detect unpinned dependencies when using nuget and dotnet clis to add ad-hoc libraries.

What is the new behavior (if this is a feature change)?**

Scorecard detects and warns when using dotnet and nuget cli to add ad-hoc libraries packages without declaring their specific version.

• [v] Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

This PR relates to but does not fix issue #1578

Special notes for your reviewer

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

Scorecard checks for unpinned dependencies that are retrieved ad-hoc using nuget and dotnet CLIs ("nuget install" and "dotnet add").

[codecov]

Codecov Report

Merging #2779 (416c737) into main (1c441f3) will decrease coverage by 4.29%.
The diff coverage is 91.42%.

❗ Current head 416c737 differs from pull request most recent head 3a0da40. Consider uploading reports for the commit 3a0da40 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2779      +/-   ##
==========================================
- Coverage   55.18%   50.90%   -4.29%     
==========================================
  Files         158      158              
  Lines       13276    12062    -1214     
==========================================
- Hits         7327     6140    -1187     
- Misses       5514     5547      +33     
+ Partials      435      375      -60     

[laurentsimon]

Thanks for the PR. I left comments about immutability of versions in nuget ecosystem because I'm unfamiliar with it.

[nkolev92]

A few comments with the limited context that I have.

BTW, how commonly used phrase is the pinned dependency concept? :)

NuGet has a CPM feature that has a similar name that'd confuse some people: https://learn.microsoft.com/en-us/nuget/consume-packages/central-package-management#transitive-pinning