NET Runtime installer signing info has version in the product field requiring new application control rules every version

The .NET Runtime installer is signed, thankfully, but the Product Name has the version in it, which is firstly redundant because the version is supposed to be in the file version, but also completely breaks application control capabilities because it necessitates either
a) A new rule every time an update is released, an extreme amount of effort to maintain across a large and diverse client base; or
b) Allowing this with path rules, which is a security risk given that the runtime extracts to TEMP, which is user-writable

See the screenshot which is from the AppLocker wizard for convenience of displaying the issue, but applies equally to App Control for Business.

The Product Name should not change based on version. That is what the File Version field is for.

The occurrence of this issue is noticed regardless of tools used to deploy the runtime; in fact we notice this issue when deploying updates to .NET Runtime via Windows Update itself, in environments where application control technologies built into Windows are in use.

The Product Name field only supports wildcards as the entire contents of the field; i.e. it is not possible to have a publisher rule matching "MICROSOFT WINDOWS DESKTOP RUNTIME - 8.*"

No source file or test is identified. Start by locating the .NET Runtime installer signing metadata and reproducing the Product Name and File Version values in AppLocker or App Control for Business. Done means Product Name remains stable across runtime versions while File Version changes.

Written by the indexing model from the issue text.