NuGet packages being detected as Private instead of Public (ex: CsWinRT)

I'm trying to generate a `NOTICE.txt` file using Component Governance tooling, but I'm running into cases where the tooling appears to detect *public* NuGet packages as *private*, instead of public (for example, the [CsWinRT](https://www.nuget.org/packages/Microsoft.Windows.CsWinRT/) package).

Here's what the Notice file reports when downloading the generated file:

I'm not sure exactly what might be causing this though. As far as I can tell we're not doing anything out-of-the-ordinary in our repo...

Here's how we refer to the CsWinRT package, from a `csproj` file:

```xml

net6.0-windows10.0.22621.0




```

We have a single private feed setup in our repo (as this is required by policy for security reasons), and it has upstream sources for public NuGet packages. This is what our top-level `nuget.config` file looks like in the repo:

```xml

```

The private feed has the public NuGet Gallery listed as an "Upstream Source":

Looking at the feed, it shows that the Microsoft.Windows.CsWinRT 2.0.0 package comes from the public NuGet Gallery feed:

Looking at our pipeline, I can see that the Component Governance Detection task successfully detects the CsWinRT package:

```
--- Component: ---
Microsoft.Windows.CsWinRT 2.0.0 - NuGet
--- Found at: ---
/csprojection/full/ProjectName.projection.csproj
/csprojection/Core/ProjectName.Core.projection.csproj
```

FWIW, there is an entry here for CsWinRT:
https://clearlydefined.io/definitions/nuget/nuget/-/Microsoft.Windows.CsWinRT/2.0.0

So, I'm not sure where/how it determines what is the package source, and why it gets flagged as "not public".