Transitive vulnerabilities should bubble up warning icons to the dependencies node for project references in VS solution explorer

[zivkan]

From internal discussion on how to enable this:

The only outstanding work I'm aware of here is showing warnings/errors on top-level dependencies. This data needs to come from the design-time build targets, via DiagnosticLevel metadata. Could the NuGet team please see whether they can add this data during DTBs?

ResolvedPackageReference returned from target ResolvePackageDependenciesDesignTime
ResolvedProjectReference returned from target ResolveProjectReferencesDesignTime2

[zivkan]

for anyone working on this, it already works for transitive packages via PackageReferences:

It "mostly" works via ProjectReferences as well:

We can see the icons flowing through transitive project references, but stopping at the direct project reference.

The work remaining is:

1. modify dotnet/sdk's ResolvePackageAssets task, and output a new item type that lists the direct project references that have a diagnostic, as long as the severity (warning or error).
2. Modify dotnet/project-system's design time build targets to merge the items from the above change into the item that the C# code ends up using to determine whether the project reference has a diagnostic that needs an overlay icon.