fix: Remove AutoMapper dependency to remediate CVE-2026-32933 (#1457)

* fix: remove AutoMapper dependency to remediate CVE-2026-32933

Replace AutoMapper 10.1.1 (and AutoMapper.Extensions.Microsoft.DependencyInjection 8.1.1)
with explicit manual property-by-property mapping in ConfigurationMapper.cs.

Changes:
- Add ConfigurationMapper with explicit MapFrom() for each Args type and ConfigFile
- Add type-safe MergeSetting<T>() for config merge with conflict detection
- Add explicit ToConfiguration() for InputConfiguration -> Configuration copy
- Refactor ConfigPostProcessor to remove IMappingAction interface dependency
- Update ConfigurationBuilder to use ConfigurationMapper directly
- Update DI registration from AddAutoMapper() to AddTransient<ConfigPostProcessor>()
- Remove AutoMapper from all 4 csproj files and Directory.Packages.props
- Delete ConfigurationProfile.cs and 9 value converter files

No reflection used - every mapped property is listed explicitly for auditability.
All 829 unit tests pass. E2E CLI tests verified (generate, validate, redact, aggregate, config merge).

* chore: remove .features from tracked files

Author: JoseRenan

Directory.Packages.props

@@ -10,8 +10,6 @@
     <ComponentDetectionPackageVersion>6.3.0</ComponentDetectionPackageVersion>
   </PropertyGroup>
   <ItemGroup>
-    <PackageVersion Include="AutoMapper" Version="10.1.1" />
-    <PackageVersion Include="AutoMapper.Extensions.Microsoft.DependencyInjection" Version="8.1.1" />
     <PackageVersion Include="Microsoft.Build" Version="17.11.48" />
     <PackageVersion Include="Microsoft.Build.Framework" Version="17.11.48" />
     <PackageVersion Include="Microsoft.Build.Locator" Version="1.9.1" />

src/Microsoft.Sbom.Api/Config/ConfigPostProcessor.cs

@@ -4,7 +4,6 @@
 using System;
 using System.Collections.Generic;
 using System.ComponentModel;
-using AutoMapper;
 using Microsoft.Sbom.Api.Output.Telemetry;
 using Microsoft.Sbom.Common;
 using Microsoft.Sbom.Common.Config;
@@ -17,7 +16,7 @@ namespace Microsoft.Sbom.Api.Config;
 /// <summary>
 /// Runs finalizing operations on the configuration once it has been successfully parsed.
 /// </summary>
-public class ConfigPostProcessor : IMappingAction<IConfiguration, IConfiguration>
+public class ConfigPostProcessor
 {
     private readonly IEnumerable<ConfigValidator> configValidators;
     private readonly ConfigSanitizer configSanitizer;
@@ -30,7 +29,7 @@ public ConfigPostProcessor(IEnumerable<ConfigValidator> configValidators, Config
         this.fileSystemUtils = fileSystemUtils ?? throw new ArgumentNullException(nameof(fileSystemUtils));
     }
 
-    public void Process(IConfiguration source, IConfiguration destination, ResolutionContext context)
+    public void Process(IConfiguration source, IConfiguration destination)
     {
         // Replace backslashes in directory paths with the OS-sepcific directory separator character.
         PathUtils.ConvertToOSSpecificPathSeparators(destination);

src/Microsoft.Sbom.Api/Config/ConfigurationBuilder.cs

@@ -2,7 +2,6 @@
 // Licensed under the MIT license. See LICENSE file in the project root for full license information.
 
 using System.Threading.Tasks;
-using AutoMapper;
 using Microsoft.Sbom.Api.Config.Args;
 using Microsoft.Sbom.Common.Config;
 using PowerArgs;
@@ -13,12 +12,12 @@ namespace Microsoft.Sbom.Api.Config;
 /// <remarks>Throws an error if the same parameters are defined in both the config file and command line.</remarks>
 public class ConfigurationBuilder<T> : IConfigurationBuilder<T>
 {
-    private readonly IMapper mapper;
+    private readonly ConfigPostProcessor configPostProcessor;
     private readonly ConfigFileParser configFileParser;
 
-    public ConfigurationBuilder(IMapper mapper, ConfigFileParser configFileParser)
+    public ConfigurationBuilder(ConfigPostProcessor configPostProcessor, ConfigFileParser configFileParser)
     {
-        this.mapper = mapper;
+        this.configPostProcessor = configPostProcessor;
         this.configFileParser = configFileParser;
     }
 
@@ -31,23 +30,23 @@ public async Task<InputConfiguration> GetConfiguration(T args)
         {
             case ValidationArgs validationArgs:
                 validationArgs.ManifestToolAction = ManifestToolActions.Validate;
-                commandLineArgs = mapper.Map<InputConfiguration>(validationArgs);
+                commandLineArgs = ConfigurationMapper.MapFrom(validationArgs);
                 break;
             case GenerationArgs generationArgs:
                 generationArgs.ManifestToolAction = ManifestToolActions.Generate;
-                commandLineArgs = mapper.Map<InputConfiguration>(generationArgs);
+                commandLineArgs = ConfigurationMapper.MapFrom(generationArgs);
                 break;
             case RedactArgs redactArgs:
                 redactArgs.ManifestToolAction = ManifestToolActions.Redact;
-                commandLineArgs = mapper.Map<InputConfiguration>(redactArgs);
+                commandLineArgs = ConfigurationMapper.MapFrom(redactArgs);
                 break;
             case FormatValidationArgs formatValidationArgs:
                 formatValidationArgs.ManifestToolAction = ManifestToolActions.ValidateFormat;
-                commandLineArgs = mapper.Map<InputConfiguration>(formatValidationArgs);
+                commandLineArgs = ConfigurationMapper.MapFrom(formatValidationArgs);
                 break;
             case AggregationArgs aggregationArgs:
                 aggregationArgs.ManifestToolAction = ManifestToolActions.Aggregate;
-                commandLineArgs = mapper.Map<InputConfiguration>(aggregationArgs);
+                commandLineArgs = ConfigurationMapper.MapFrom(aggregationArgs);
                 break;
             default:
                 throw new ValidationArgException($"Unsupported configuration type found {typeof(T)}");
@@ -59,10 +58,10 @@ await configFileParser.ParseFromJsonFile(commandLineArgs.ConfigFilePath.Value) :
             new ConfigFile();
 
         // Convert config file arguments to configuration.
-        var configFileArgs = mapper.Map<ConfigFile, InputConfiguration>(configFromFile);
+        var configFileArgs = ConfigurationMapper.MapFrom(configFromFile);
 
         // Combine both configs, include defaults.
-        return mapper.Map(commandLineArgs, configFileArgs);
+        return ConfigurationMapper.Merge(commandLineArgs, configFileArgs, configPostProcessor);
     }
 }