nuget: parse .csproj and packages.config files

[schischi]

Add support for 2 manifest files:

• packages.config: XML file holding the list of package dependencies;
• *.csproj: describe a project with dependencies (NuGet package references);

The manifest files do not contain a lot of info, but enough to build a package-url.

fixes #2392

[pombredanne]

@schischi Thanks you ++
This is needed and long overdue alright!
There also is another tool -- if .NET and C# are your poison of choice -- at https://github.com/nexB/nuget-inspector which is written in C# and is designed to also resolve .NET dependencies. It handles many if not all current and legacy manifests formats including all the *.*proj variants, packages.config and various more recent JSON files that dotnet, msbuild and Visual Studio dabble with. See https://github.com/nexB/nuget-inspector/blob/main/src/nuget-inspector/ProjectScanner.cs for some entry point.

It is much more involved and bigger than a plain parser as it uses the native NuGet and .NET libraries for better or worse.

The inspector also has an extensive test suite which may come handy for the staic analysis here.