`Microsoft.EntityFrameworkCore.Design` breaks builds due to dependency on 'NuGet.Packaging' & 'NuGet.Protocol'

## File a bug

The NuGet packages 'NuGet.Packaging' & 'NuGet.Protocol' break builds when the NuGet package "Microsoft.EntityFrameworkCore.Design" is linked to any project that treats warnings as errors.

These NuGet packages have reported security vulnerabilities, see https://www.nuget.org/packages/NuGet.Packaging/6.12.1
and this project dependencies in [Version](https://github.com/dotnet/Scaffolding/blob/main/eng/Versions.props).

```xml
6.12.1
```

```log
Web.csproj: [NU1901] Warning As Error: Package 'NuGet.Packaging' 6.12.1 has a known low severity vulnerability, https://github.com/advisories/GHSA-g4vj-cjjj-v7hg
Web.csproj: [NU1901] Warning As Error: Package 'NuGet.Protocol' 6.12.1 has a known low severity vulnerability, https://github.com/advisories/GHSA-g4vj-cjjj-v7hg
```

### Include your code

```csproj

True

```
Or whatever settings are needed to switch warnings as errors.

Program.cs
```csharp
Console.WriteLine("Hello, World!");
```

### Include stack traces

```bash
dotnet nuget why ./LWDD.slnx 'NuGet.Packaging'

Projekt LWDD.Web has the following dependency graph for NuGet.Packaging:

[net10.0]
└── Microsoft.VisualStudio.Web.CodeGeneration.Design (v10.0.2)
├── Microsoft.DotNet.Scaffolding.Shared (v10.0.2)
│ ├── NuGet.Packaging (v6.12.1)
│ └── NuGet.ProjectModel (v6.12.1)
│ └── NuGet.DependencyResolver.Core (v6.12.1)
│ └── **NuGet.Protocol (v6.12.1) ** // <-- THIS IS THE PROBLEM
│ └── NuGet.Packaging (v6.12.1) // <-- THIS IS THE PROBLEM
├── Microsoft.VisualStudio.Web.CodeGenerators.Mvc (v10.0.2)
│ ├── Microsoft.DotNet.Scaffolding.Shared (v10.0.2)
│ │ ├── NuGet.Packaging (v6.12.1)
│ │ └── NuGet.ProjectModel (v6.12.1)
│ │ └── NuGet.DependencyResolver.Core (v6.12.1)
│ │ └── NuGet.Protocol (v6.12.1)
│ │ └── NuGet.Packaging (v6.12.1)
│ ├── Microsoft.VisualStudio.Web.CodeGeneration (v10.0.2)
│ │ ├── Microsoft.VisualStudio.Web.CodeGeneration.EntityFrameworkCore (v10.0.2)
│ │ │ ├── Microsoft.DotNet.Scaffolding.Shared (v10.0.2)
│ │ │ │ ├── NuGet.Packaging (v6.12.1)
│ │ │ │ └── NuGet.ProjectModel (v6.12.1)
│ │ │ │ └── NuGet.DependencyResolver.Core (v6.12.1)
│ │ │ │ └── NuGet.Protocol (v6.12.1)
│ │ │ │ └── NuGet.Packaging (v6.12.1)
│ │ │ ├── Microsoft.VisualStudio.Web.CodeGeneration.Core (v10.0.2)
│ │ │ │ ├── Microsoft.VisualStudio.Web.CodeGeneration.Templating (v10.0.2)
│ │ │ │ │ ├── Microsoft.VisualStudio.Web.CodeGeneration.Utils (v10.0.2)
│ │ │ │ │ │ ├── Microsoft.DotNet.Scaffolding.Shared (v10.0.2)
│ │ │ │ │ │ │ ├── NuGet.Packaging (v6.12.1)
│ │ │ │ │ │ │ └── NuGet.ProjectModel (v6.12.1)
│ │ │ │ │ │ │ └── NuGet.DependencyResolver.Core (v6.12.1)
│ │ │ │ │ │ │ └── NuGet.Protocol (v6.12.1)
│ │ │ │ │ │ │ └── NuGet.Packaging (v6.12.1)
│ │ │ │ │ │ ├── NuGet.Packaging (v6.12.1)
│ │ │ │ │ │ └── NuGet.ProjectModel (v6.12.1)
│ │ │ │ │ │ └── NuGet.DependencyResolver.Core (v6.12.1)
│ │ │ │ │ │ └── NuGet.Protocol (v6.12.1)
│ │ │ │ │ │ └── NuGet.Packaging (v6.12.1)
│ │ │ │ │ ├── NuGet.Packaging (v6.12.1)
│ │ │ │ │ └── NuGet.ProjectModel (v6.12.1)
│ │ │ │ │ └── NuGet.DependencyResolver.Core (v6.12.1)
│ │ │ │ │ └── NuGet.Protocol (v6.12.1)
│ │ │ │ │ └── NuGet.Packaging (v6.12.1)
│ │ │ │ ├── NuGet.Packaging (v6.12.1)
│ │ │ │ └── NuGet.ProjectModel (v6.12.1)
│ │ │ │ └── NuGet.DependencyResolver.Core (v6.12.1)
│ │ │ │ └── NuGet.Protocol (v6.12.1)
│ │ │ │ └── NuGet.Packaging (v6.12.1)
│ │ │ ├── NuGet.Packaging (v6.12.1)
│ │ │ └── NuGet.ProjectModel (v6.12.1)
│ │ │ └── NuGet.DependencyResolver.Core (v6.12.1)
│ │ │ └── NuGet.Protocol (v6.12.1)
│ │ │ └── NuGet.Packaging (v6.12.1)
│ │ ├── NuGet.Packaging (v6.12.1)
│ │ └── NuGet.ProjectModel (v6.12.1)
│ │ └── NuGet.DependencyResolver.Core (v6.12.1)
│ │ └── NuGet.Protocol (v6.12.1)
│ │ └── NuGet.Packaging (v6.12.1)
│ ├── NuGet.Packaging (v6.12.1)
│ └── NuGet.ProjectModel (v6.12.1)
│ └── NuGet.DependencyResolver.Core (v6.12.1)
│ └── NuGet.Protocol (v6.12.1)
│ └── NuGet.Packaging (v6.12.1)
├── NuGet.Packaging (v6.12.1)
└── NuGet.ProjectModel (v6.12.1)
└── NuGet.DependencyResolver.Core (v6.12.1)
└── NuGet.Protocol (v6.12.1)
└── NuGet.Packaging (v6.12.1)
```

### Include provider and version information

Microsoft.VisualStudio.Web.CodeGeneration.Design/Microsoft.DotNet.MSIdentity version: v10.0.2
Target framework: .NET 10
Operating system: Arch Linux + Windows 11
IDE: Visual Studio 2026, Rider 2026.1, dotnet CLI

### Related issues

#2044