Expand description
packages.lock.json parser.
Every field except the package name is optional (S2): "type": "Project" and
"type": "CentralTransitive" entries carry requested but no resolved at all — a
required resolved field would abort deserialization of the entire file, which would
only surface on multi-project solutions and not on the single-project fixture a test is
most likely to use. Entries without resolved are simply skipped.
packages.<project_name>.lock.json (per-project lock files, used when multiple projects
share a directory) cannot be expressed as an exact name —
NuGetLockParser::locate_lockfile falls back to that computed name (<project_name>
being the manifest’s own file stem, NuGet’s convention) once the exact
packages.lock.json name misses (D3, #451). This must be an exact match against this
manifest’s project name, not the first packages.*.lock.json found in the directory —
a directory shared by multiple projects can hold several such files, and taking the
first one silently attaches an unrelated project’s resolved versions (#451 follow-up,
tester-found regression).