Bug

Fixes: https://github.com/NuGet/Client.Engineering/issues/3435

Description

Direct dependencies in PM UI were using a VulnerablePackageMetadataCapability in the package model. The model instead needs to leverage the vulnerability service so that either the vulnerability data from the Package Source resources can be used, or the Audit Source, if configured.

Validation

• All existing unit tests still pass.
• Validated nuget.org as a package source, a Top-Level & Transitive dependency both reflect vulnerabilities
• Validated nuget.org as an Audit source (only), a Top-Level & Transitive dependency both reflect vulnerabilities
• Validated that with no vulnerability resource (eg, here I removed nuget.org entirely), the PM UI renders the Installed packages with no vulnerability data.

PR Checklist

• Meaningful title, helpful description and a linked NuGet/Home issue
• Added tests
• Link to an issue or pull request to update docs if this PR changes settings, environment variables, new feature, etc.