Fix CG issue for Microsoft.IO.Redist (#81223)

Backport of #74653

Author: JoeRobich

eng/Directory.Packages.props

@@ -227,11 +227,14 @@
     <PackageVersion Include="System.Threading.Channels" Version="7.0.0" />
 
     <!--
-      System.Net.Http and System.Private.Uri are used to eliminate our reference to old packages with vulnerability.
-      They are introduced by other component. Tracked issues:https://github.com/xunit/xunit/issues/2778 and https://devdiv.visualstudio.com/DevDiv/_workitems/edit/1886496
+      Packages that are pinned to avoid component governance alerts.
+      Tracked issues:
+        https://github.com/xunit/xunit/issues/2778
+        https://devdiv.visualstudio.com/DevDiv/_workitems/edit/1886496
     -->
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
     <PackageVersion Include="System.Private.Uri" Version="4.3.2" />
+    <PackageVersion Include="Microsoft.IO.Redist" Version="6.0.1" />
 
     <PackageVersion Include="SQLitePCLRaw.core" Version="$(SqliteVersion)" />
     <PackageVersion Include="SQLitePCLRaw.bundle_green" Version="$(SqliteVersion)" />

src/Workspaces/Core/MSBuild.BuildHost/Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj

@@ -43,6 +43,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.Build.Locator" PrivateAssets="All" />
     <PackageReference Include="Microsoft.Extensions.Logging.Console" />
+    <PackageReference Include="Microsoft.IO.Redist" Condition="'$(TargetFrameworkIdentifier)' != '.NETCoreApp'" />
     <PackageReference Include="Newtonsoft.Json" />
     <PackageReference Include="System.CommandLine" />
     <PackageReference Include="System.Text.Json" VersionOverride="8.0.5" PrivateAssets="All" Condition="'$(DotnetBuildFromSource)' != 'true'"/>