Dotnet list package --vulnerable uses AuditSources

[Nigusu-Allehu]

Bug

Fixes: NuGet/Home#13767

Description

Design Spec: https://github.com/NuGet/Home/blob/dev/accepted/2024/Dotnet-list-package-vulnerable-uses-auditsources.md

I had the following PR, but I could not reopen it after rebasing : #6206

This PR updates dotnet list package --vulnerable to use user configured <AuditSources>.

Currently, the command only looks into <PackageSources> to load vulnerability data. However, with the introduction of NuGet Audit, other commands now support <AuditSources> to specify vulnerability data sources. This PR makes sure dotnet list package --vulnerable is also up to date and supports <AuditSources>

In order to do a manual test, I specified a package that has only one vulnerability data source. That source is only specified as an Audit source. This is what running dotnet list package --vulnerable results in before and after this PR

Before

After

PR Checklist

• Meaningful title, helpful description and a linked NuGet/Home issue
• Added tests
• Link to an issue or pull request to update docs if this PR changes settings, environment variables, new feature, etc. Update doc: dotnet list package --vulnerable uses AuditSources Home#14021

[dotnet-policy-service]

Added needs-breaking-change-doc-created label because this PR has the breaking-change label.

When you commit this breaking change:

1. Create and link to this issue a matching issue in the dotnet/docs repo using the breaking change documentation template, then remove this needs-breaking-change-doc-created label.
2. Ask a committer to mail the .NET SDK Breaking Change Notification email list.

You can refer to the .NET SDK breaking change guidelines

[Nigusu-Allehu]

Breaking change doc: dotnet/docs#46042