Fix Snyk workflow failure caused by broad project auto-discovery

[Copilot]

The Snyk GitHub Actions job was failing because --all-projects picked up generated NuGet assets under obj/, including a project.assets.json path that depends on a missing PackageOverrides.txt in the runner’s .NET reference packs. This change narrows the workflow to the actual repository projects and avoids scanning transient build output.

• Scope the scan to real project manifests

  • Replace snyk test --all-projects / snyk monitor --all-projects with explicit scans of:
    • src/Community.PowerToys.Run.Plugin.Templates.csproj
    • tests/Community.PowerToys.Run.Plugin.Templates.Tests.csproj
  • Store the project list once in workflow env to keep scan targets centralized.

• Restore the intended solution explicitly

  • Change restore from repository-wide discovery to dotnet restore Templates.sln.
  • Keeps dependency resolution aligned with the template/test solution instead of incidental files in the workspace.

• Harden failure behavior

  • Run test and monitor sequentially per project in PowerShell.
  • Exit immediately on any Snyk command failure rather than continuing through the remaining targets.

env:
  SNYK_PROJECTS: |
    src/Community.PowerToys.Run.Plugin.Templates.csproj
    tests/Community.PowerToys.Run.Plugin.Templates.Tests.csproj

- name: Test and monitor
  shell: pwsh
  run: |
    $projects = $env:SNYK_PROJECTS -split "\r?\n" | Where-Object { $_ }

    foreach ($project in $projects) {
      snyk test --file=$project --package-manager=nuget
      if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      snyk monitor --file=$project --package-manager=nuget
      if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
    }