Add back some recently removed packages

[MichaelSimons]

Adding back the following packages:

referencePackages/src/system.formats.asn1/8.0.0
referencePackages/src/system.security.cryptography.pkcs/8.0.0
referencePackages/src/system.security.cryptography.xml/8.0.0
referencePackages/src/system.text.json/8.0.4

These packages were removed in #1108 but #1110 and #1109 which were merged after added dependencies on them. It was not caught in validation because the packages existed in the n-1 self-reference. This would be solved by dotnet/source-build#1690.

[ellahathaway]

Orthogonal to the changes in this PR - it's unfortunate that we have to reintroduce referencePackages/src/system.formats.asn1/8.0.0 due to its CVE, which is causing CG alerts in SBRP: dotnet/source-build#4751.

I understand it's necessary in this case, but I wonder if we could have implemented something in PR validation to detect that the packages referencing this dependency are dependent on a package with a CVE.

[NikolaMilosavljevic]

Are DependencyPackageProjects entries in eng/Build.props also needed?

[MichaelSimons]

Are DependencyPackageProjects entries in eng/Build.props also needed?

No because the packages are already in the n-1 artifacts.

[ViktorHofer]

Orthogonal to the changes in this PR - it's unfortunate that we have to reintroduce referencePackages/src/system.formats.asn1/8.0.0

System.Security.Cryptography.Pkcs/8.0.0 is the only package that references System.Formats.Asn/8.0.0. Should we patch SSCP to reference the 8.0.1 version of SFAsn1 instead?

[MichaelSimons]

System.Security.Cryptography.Pkcs/8.0.0 is the only package that references System.Formats.Asn/8.0.0. Should we patch SSCP to reference the 8.0.1 version of SFAsn1 instead?

Yes that is the way to address the CG. That work will be done as part of dotnet/source-build#4751.

[ViktorHofer]

I should have done that in my original PR but missed it - sorry.