Migrate vcpkg and Go detectors from Newtonsoft.Json to System.TextJson

[JamieMagee]

• VcpkgComponentDetector: Replace JsonConvert.DeserializeObject with JsonSerializer.Deserialize
• GoCLIParser: Replace JsonTextReader/JsonSerializer with Utf8JsonReader for parsing multi-object JSON output from go list
  • .NET 9 added AllowMultipleValues, but unfortunately we are still on .NET 8
• Add explicit [JsonPropertyName] attributes to vcpkg contract classes using SPDX 2.2.1 schema field names

Part of #231

[codecov]

Codecov Report

❌ Patch coverage is 98.47095% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.1%. Comparing base (b88d00b) to head (bd4dcaa).

Files with missing lines	Patch %	Lines
...onentDetection.Detectors/go/Parsers/GoCLIParser.cs	83.3%	4 Missing ⚠️
...ection.Detectors.Tests/GoComponentDetectorTests.cs	94.1%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #1570     +/-   ##
=======================================
- Coverage   89.5%   89.1%   -0.5%     
=======================================
  Files        427     428      +1     
  Lines      36270   36561    +291     
  Branches    2262    2271      +9     
=======================================
+ Hits       32496   32608    +112     
- Misses      3311    3494    +183     
+ Partials     463     459      -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR migrates the vcpkg and Go detectors from Newtonsoft.Json to System.Text.Json, continuing the broader effort tracked in #231 to standardize on the built-in JSON library. The changes replace JsonConvert.DeserializeObject with JsonSerializer.Deserialize in vcpkg, implement a custom multi-JSON-object parser for Go CLI output using Utf8JsonReader, and add explicit [JsonPropertyName] attributes to vcpkg contract classes to match the SPDX 2.2.1 schema.

Key changes:

• VcpkgComponentDetector replaces Newtonsoft.Json deserialization calls with System.Text.Json equivalents
• GoCLIParser implements custom parsing logic for Go CLI's multi-object JSON output (newline-separated JSON objects)
• All vcpkg contract classes receive explicit JsonPropertyName attributes matching SPDX field names

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/Microsoft.ComponentDetection.Detectors/vcpkg/VcpkgComponentDetector.cs	Replaces JsonConvert.DeserializeObject calls with JsonSerializer.Deserialize, removes Newtonsoft.Json using statement
src/Microsoft.ComponentDetection.Detectors/vcpkg/Contracts/VcpkgSBOM.cs	Adds JsonPropertyName attributes for packages and name properties
src/Microsoft.ComponentDetection.Detectors/vcpkg/Contracts/Package.cs	Adds JsonPropertyName attributes for all properties matching SPDX 2.2.1 schema
src/Microsoft.ComponentDetection.Detectors/vcpkg/Contracts/ManifestInfo.cs	Removes duplicate Newtonsoft.Json attribute, keeps System.Text.Json attribute
src/Microsoft.ComponentDetection.Detectors/vcpkg/Contracts/Annotation.cs	Adds JsonPropertyName attributes for all properties matching SPDX schema
src/Microsoft.ComponentDetection.Detectors/go/Parsers/GoCLIParser.cs	Replaces Newtonsoft.Json's JsonTextReader with custom Utf8JsonReader loop for parsing multi-object JSON output

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.