Fixes #51320

Customer Impact

• Customer reported
• Found internally

1. Referencing System.Collections.Immutable, System.ComponentModel.Composition, System.Reflection.TypeExtensions, System.Runtime.Loader, System.Security.AccessControl, System.Security.Principal.Windows from a NETStandard2.1 build would fail to compile after enabling pruning.
2. System.DirectoryServices was pruned at too high a version, which could lead to ref-def mismatch errors at runtime in frameworks older than net8.0, as the framework copy would be used instead of package. (unsupported framework versions)
3. All of WindowsDekstop in net9.0 was pruning only 8.0 package versions. No customer impact other than pruning less than we could.
4. System.Drawing.Common was pruned at too high a version on netcoreapp3.0 which could lead to ref-def mismatch errors at runtime. (unsupported framework version)
5. Many packages in netstandard2.0 were pruned at lower versions due to inconsistent facade assembly versioning in netstandard (corefx servicing interaction with standard repo). Many of these packages would be pruned by other packages which depended on them, but not directly. No customer impact other than pruning less than we could.
6. Referencing System.Security.Cryptography.Pkcs from ASPNETCore would fail to compile after enabling pruning. This package was not exposed for reference, so it shouldn't be pruned. ASP.NETCore contains System.Security.Cryptography.Pkcs but does not expose for reference aspnetcore#64125

Regression

• Yes
• No

Regression caused when enabling pruning. Customer with a project that works will face these issues when adding a net10 target to a multi-targeted project, or manually enabling package pruning.

Testing

Fixed the initial customer report, then did extensive adhoc testing by restoring pruned package versions for every framework version and comparing the result to references exposed for that framework.

https://github.com/ericstj/scratch/tree/pruningTest

Example tests:

1. Assemblies missing for framework but available from pruned packages.
2. Assembly version mismatch between pruned (higher) and framework.
3. API Compatibility issue between pruned package and framework.
4. Later version of pruned framework prunes less than previous.

Risk

Low: In most cases pruned data is pruning less. Test methodology can observe the results of these changes to ensure they don't have side-effects other than desired.

@dsplaisted @nkolev92