Enable NuGet Audit for security vulnerability scanning

[Copilot]

NuGet Audit was previously disabled. This re-enables it to detect vulnerable packages during restore.

Changes

• Added explicit NuGet Audit configuration to Directory.Build.props:
  • NuGetAudit=true - Enable scanning
  • NuGetAuditLevel=low - Report all severity levels
  • NuGetAuditMode=all - Audit direct and transitive dependencies

Current package set has no known vulnerabilities.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[release/8.0.4xx] Enable Nuget Audit</issue_title>
<issue_description>Disabled in https://dev.azure.com/dnceng/internal/_git/dotnet-sdk/pullrequest/54678.
We should re enable it and bump some packages</issue_description>

<agent_instructions>It was disabled in directory.build.props. Reenable it and see what it flags.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes [release/8.0.4xx] Enable Nuget Audit #51466

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[marcpopMSFT]

@dkurepa was you're issue specifically about turning audit back on in 8 or is main sufficient?
#51466

[marcpopMSFT]

/backport to release/8.0.4xx

[github-actions]

Started backporting to release/8.0.4xx (link to workflow run)

[github-actions]

@marcpopMSFT backporting to release/8.0.4xx failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Creating an empty commit: Initial plan
Applying: Enable NuGet Audit in Directory.Build.props
Using index info to reconstruct a base tree...
M	Directory.Build.props
Falling back to patching base and 3-way merge...
Auto-merging Directory.Build.props
CONFLICT (content): Merge conflict in Directory.Build.props
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0002 Enable NuGet Audit in Directory.Build.props
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output