🐛 Detect implicit NuGet restores

[theinfosecguy]

What kind of change does this PR introduce?

Bug fix for the Pinned-Dependencies check.

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

Pinned-Dependencies records explicit dotnet restore commands but misses commands that restore automatically, including dotnet build, dotnet test, dotnet pack, and dotnet publish.

It also skips Windows PowerShell workflow steps, so the workflow from #4381 reports no NuGet command details.

What is the new behavior (if this is a feature change)?

Pinned-Dependencies records these implicit restore commands unless restore is disabled with --no-restore or --no-build. It also recognizes MSBuild restore forms and simple direct dotnet or MSBuild commands in PowerShell workflow steps.

PowerShell parsing is intentionally conservative. Multiline, compound, and dynamic commands remain skipped because handling them safely requires a complete parser.

The existing locked-mode checks still determine whether the restored dependencies are pinned.

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #4381

Special notes for your reviewer

I reproduced #4381 locally. Before this change, Pinned-Dependencies missed the restores triggered by dotnet build, dotnet test, and dotnet pack. It now reports all three.

make all gets through the build and race-enabled tests on my machine, then stops at lint. The two lint errors are in policy/ and also occur on the parent commit. Linting just this diff reports no issues.

Does this PR introduce a user-facing change?

The Pinned-Dependencies check now detects implicit NuGet restores from `dotnet build`, `dotnet pack`, `dotnet publish`, and `dotnet test`, including simple PowerShell workflow commands.

[dosubot]

📄 Knowledge review

Dosu skipped reviewing this PR because your organization has used its 200 included credits for the month. Your usage will reset on 2026-09-01. To have Dosu review this PR before then, ask your organization admin to upgrade to a pro account.

---