Framework package updates

[ericstj]

Include non-implementation packages on .NETCore 2.x

Microsoft.NETCore.App contains only reference assemblies, but it was listed in CVEs, so should be excluded. The same is true for System.Private.Uri.
I did not include these previously because they weren't part of package overrides list, nor were they found through package comparisons - since conflict resolution doesn't need to do anything with non-implementation packages. They are important for CG though since they've been used in CVE reports.

Include framework packages for .NET 4.6.1

.NET 4.6.1 supports .NET Standard and has built in support for it that will win over nuget packages.
In .NET 4.6.1 - .NET 4.7.1 this comes from the Microsoft.NET.Build.Extensions component, after that it's built into the framework itself.

@grvillic

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.6%. Comparing base (7721f99) to head (4ce149c).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #1308     +/-   ##
=======================================
- Coverage   89.6%   89.6%   -0.1%     
=======================================
  Files        378     379      +1     
  Lines      29960   29966      +6     
  Branches    1840    1840             
=======================================
+ Hits       26862   26867      +5     
  Misses      2707    2707             
- Partials     391     392      +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

---

🚨 Try these New Features:

• Flaky Tests Detection - Detect and resolve failed and flaky tests

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂