Report each policy violation once instead of once per project

[dennisdoomen]

What changed

• The NuGet analysis now reports a package that violates the policy once, with all the projects that violate it, instead of once per project.
• Each violation lists only the projects that actually broke the policy, not every project seen so far.
• Added a unit test for merging violations.

Why

The NuGet analysis checks every project on its own. A package that failed in several projects was printed several times, and each entry listed a longer project list than the one before. In a solution with 14 test projects, one FluentAssertions violation appeared 14 times.

Notes for reviewers

• The merge happens in ProjectAnalyzer, so it also covers the npm and risk-based violations. Violations are grouped by package, version, reason, warning flag and malicious flag.
• A package that is denied in one project and only warned about in another stays as two entries, because the reasons differ.

🤖 Generated with Claude Code

[github-actions]

Test Results

  3 files  ±0    3 suites  ±0   5m 43s ⏱️ - 1m 2s
487 tests +1  487 ✅ +1  0 💤 ±0  0 ❌ ±0 
973 runs  +2  973 ✅ +2  0 💤 ±0  0 ❌ ±0 

Results for commit d715b7b. ± Comparison against base commit f730278.

[coveralls]

Coverage Report for CI Build 39115745205

Coverage increased (+0.03%) to 81.097%

Details

• Coverage increased (+0.03%) from the base build.
• Patch coverage: 1 uncovered change across 1 file (10 of 11 lines covered, 90.91%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
Src/PackageGuard.Core/CSharp/CSharpProjectAnalysisStrategy.cs	3	2	66.67%
Total (2 files)	11	10	90.91%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	9547
Covered Lines:	7990
Line Coverage:	83.69%
Relevant Branches:	3472
Covered Branches:	2568
Branch Coverage:	73.96%
Branches in Coverage %:	Yes
Coverage Strength:	1767.27 hits per line

---

💛 - Coveralls