Support package.lock.json for dotnet

[scrocquesel-ml150]

Is your feature request related to a problem? Please describe.
Currently, it seems that ODC scans only the csproj files. Doing so, it is blind to transitive dependencies. For exemple, there is a CVE for the package System.Text.Json but you rarely reference it directly as it part of meta package..

Describe the solution you'd like
Since .net 2.1, one can enable RestorePackagesWithLockFile. This produces a packages.lock.json file alongisde each csproj with the full dependency tree. This file is usually commited to enable a repeatable build process.
When a package lock file is found, the MSbuild analyser should use it instead of resolving package references from the csproj.

Describe alternatives you've considered
N/A

Additional context
An exemple of implementation in a sbom tools : https://github.com/CycloneDX/cdxgen/blob/ab161c3561eeac2447a2902fb3d15b60610d6a33/lib/helpers/utils.js#L8316