finding-owning-csproj

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The test Dockerfile pulls the base image mcr.microsoft.com/dotnet/sdk:9.0 and runs dotnet tool install --global findproject which fetches and installs/executes the remote package (from NuGet, e.g. https://www.nuget.org/packages/findproject) at test/runtime, so external code is fetched and run.