Add PackageDownload vulnerability telemetry

[Nigusu-Allehu]

Bug

Fixes: https://github.com/NuGet/Client.Engineering/issues/3112

Description

Telemetry design https://github.com/NuGet/Client.Engineering/blob/main/designs/telemetry/telemetry-design-PackageDownload-vulnerabilities.md
This PR introduces telemetry collection for vulnerabilities in <PackageDownload> packages:

Summary of Changes

• Collects the list of vulnerable package IDs at the end of the restore operation.

Goals

This telemetry will enable us to:

• Determine how many restore operations generate warnings due to vulnerable <PackageDownload> packages.
• Use package names to estimate the proportion of warnings attributable to SDK-managed packages.

PR Checklist

• Meaningful title, helpful description and a linked NuGet/Home issue
• Added tests
• Link to an issue or pull request to update docs if this PR changes settings, environment variables, new feature, etc.

[nkolev92]

Consider using a telemetry template issue: https://github.com/NuGet/Client.Engineering/issues/new?assignees=&labels=Type%3AEngineering%2CPriority%3A2&projects=&template=telemetry.md.

I think we've forgotten to use it reliable (includes all of us :) )

[zivkan]

I'm confident that this PR now achieves its stated goal, without introducing regressions.

I still think we can make improvements to reduce the risk of future regressions though.