fix(dotnet): preserve requested version range in packages.lock.json metadata (#5211)

[CAOShurong]

Description

The packages.lock.json parser dropped the requested field entirely, so downstream consumers lose the original version-range constraint (e.g. [13.0.3, )) that the project declared in its lockfile.

This PR:

• Adds Requested to the DotnetPackagesLockEntry struct (json:"requested,omitempty" — omitempty keeps Transitive entries that declare no requested value clean).
• Populates it from the parsed dependency in newDotnetPackagesLockPackage.
• Extends the existing TestParseDotnetPackagesLock golden package expectations with the resolved requested ranges.

This closes the lossiness half of #5211. The determinism and Direct-preference halves are handled separately in #5210 (maintainer fix), which I independently verified in round rev 79. This change is orthogonal and stacks cleanly on top of it.

Verification

• go test ./syft/pkg/cataloger/dotnet/ -run TestParseDotnetPackagesLock -count=10 → PASS (also go vet clean).

• End-to-end on a byte-identical packages.lock.json fixture where Newtonsoft.Json is declared Direct with requested: "[13.0.3, )":

  "metadata": {
    "name": "Newtonsoft.Json",
    "version": "13.0.3",
    "contentHash": "HrC5BXdl00IP9zeV+0Z848QWPAoCr9P3bDEZguI+gkLcBKAOxix/tLEAAHC+UvDNPv4a2d18lOReHMOagPa+zQ==",
    "type": "Direct",
    "requested": "[13.0.3, )"
  }

  Before this change, requested was absent.

The other dotnet-cataloger tests that shell out to docker fail in this environment for lack of a Docker daemon — they are unrelated to this change and fail identically on unmodified main.

Checklist

• Added/updated tests (the golden TestParseDotnetPackagesLock expectations now assert Requested).
• Used DCO-signed commits (Signed-off-by: Shurong Cao <170531907+CAOShurong@users.noreply.github.com>).

Relates to #5211.

🤖 Generated with Claude Code