NuGet: add support for extra manifests

### Description
Beyond the base `.nuspec` manifest file there are several other files we should detect and report:

- `packages-config`: See https://docs.microsoft.com/en-us/nuget/reference/packages-config

This is an XML file and it mostly lists the dependencies of a project. This is a "legacy" format
It is somewhat related to the packages.lock.json too.
```xml

```

- `project.json` and `project.lock.json` See https://docs.microsoft.com/en-us/nuget/archive/project-json

This is a JSON file and mostly list dependencies though it can store some extra attributes . This is a "legacy" NuGet 3.x+ format. The lock file is also JSON.

```json
"dependencies": {
"Microsoft.NETCore": "5.0.0",
"System.Runtime.Serialization.Primitives": "4.0.10"
}
```

- `PackageReference` See https://docs.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files (therefore is XML)

It stores NuGet dependencies in the VS projects files directly under a PackageReference node.

```xml

```

Notes: Projects that use PackageReference do not use packages.config.

See also #648