Incorrectly reported dotnet package versions

**What happened**:
dotnet/package.go cataloger incorrectly picks FileVersion instead of ProductVersion.
This results in inaccurate component version reported which in turn is causing vulnerabilities being not matched in Grype.

For example in System.Text.Json package:
Reported version: 8.0.324.11423 -> this is from FileVersion field
Expected version: 8.0.3+9f4b1f5d664afdfc80e1508ab7ed099dff210fbd -> from ProductVersion field

as a result Grype treats this package NOT vulnerable where in fact it is (see https://www.nuget.org/packages/System.Text.Json/8.0.3) and this is because 8.0.324 > 8.0.3.

Another example with exactly the same behavior is in Azure.Identity:
Reported version: 1.1100.324.25704 -> this is FileVersion field
Expected version: 1.11.3+06dd672e59d9bd6068e8ef282cb94ae17e6f75be -> from ProductVersion field

Grype as well doesn't see issue here because 1.1100 > 1.11

**What you expected to happen**:
Report component version basing on ProductVersion field and use FileVersion field only when the former hasn't been correctly detected.

**Steps to reproduce the issue**:
Pick a binary System.Text.Json.dll package from https://www.nuget.org/packages/System.Text.Json/8.0.3
and run syft scan on a project folder containing it. Reported version will be similar to 8.0.324.11423 which is inaccurate.

**Anything else we need to know?**:
Suggested solution:

Instead of complicated and inaccurate logic from dotnet/package.go:findVersionFromVersionResources(),
use simple logic as in pe_package.go:findVersionFromVR() which picks ProductVersion if it is available, i.e.:

if productVersion != "" {
return productVersion
}
return fileVersion

**Environment**:
- Output of `syft version`:
syft 1.26.1
- OS (e.g: `cat /etc/os-release` or similar):
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=22.04
DISTRIB_CODENAME=jammy
DISTRIB_DESCRIPTION="Ubuntu 22.04.5 LTS"

Start in dotnet/package.go at findVersionFromVersionResources() and compare its behavior with pe_package.go:findVersionFromVR(). Reproduce the issue by scanning a project containing a System.Text.Json 8.0.3 binary with syft; done means the reported version comes from ProductVersion when available and falls back to FileVersion otherwise.

Written by the indexing model from the issue text.