feat: add cataloger for NuGet packages

[Kemosabert]

Description

This PR adds a cataloger for NuGet lockfiles in the form of packages.lock.json files.

• Fixes Support cataloging NuGet packages #373

Type of change

• New feature (non-breaking change which adds functionality)

Checklist:

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

[spiffcs]

Thanks for the PR @Kemosabert! I hope you don't mind I added some questions to get a better handle on the package lock specification.

[spiffcs]

I think this might need a better abstraction for this debug message to be helpful. Which map? What does the pkgMap represent? Are allDependencies only inclusive of dotNetPkgs or can they be other types?

Apologies for all the question on this review. Is there a good reference or specification document I can look at for the lockfile so it's easier to maybe build a mental model of what we're cataloging here? That might aid in the review and help me understand if the relationships being created are correct.

From what I am reading the lockfile is:

dependencies[topPackages]map[subPackages]metadata

where topPackages and subPackages can be > 1

Is pkg map just inclusive of topPackages?

[Kemosabert]

I went mainly off off this document here: https://github.com/NuGet/Home/wiki/Enable-repeatable-package-restore-using-lock-file and looking at lockfiles that I could generate myself with examples.

I updated the debug message and the logic as well. The test packages.lock.json file is one I generated using dotnet commands and includes a few examples of how it handles conflicting dependencies and versions.

[Kemosabert]

@spiffcs would you mind to have another look at this when you have some time, happy to hear more suggestions/feedback 👍

[spiffcs]

Thanks @Kemosabert - I'm traveling this afternoon, but put this back at the top to add some commits for the SA/Unit tests that are failing. The changes look good and I appreciate the link to documentation showing what you followed for implementation!