VCST-5372: Distribute NuGet vulnerability-audit settings to module repos

[AndrewEhlo]

Distribute NuGet vulnerability-audit settings to module repos

Adds a mechanism to centrally distribute shared MSBuild build props (starting with NuGet vulnerable-dependency auditing) to all vc-module-* repos, mirroring how workflow templates are already deployed.

What & why

Modules build with TreatWarningsAsErrors=true, so NuGet audit advisories (NU190x) fail CI. This centralizes the audit policy in one owned file instead of per-repo config drift.

• common-build-props/nuget-audit.props — owned audit config: NuGetAudit=true, NuGetAuditMode=all, NuGetAuditLevel=high, plus a per-advisory suppress list (blunt NoWarn avoided so new high/critical vulns still surface).
• deploy-module-build-props.yml — new manual workflow. Copies the props into each module and injects a marker-delimited <Import> into the module's own Directory.Build.props — imported, never overwritten, so per-module settings (VersionPrefix, etc.) are preserved. Fails loudly if a module has no Directory.Build.props.
• scripts/ensure-build-props-import.sh — shared copy+inject logic (idempotent), used by both the deploy workflow and module creation.
• modules.json — single source of the module list, consumed via a prepare job + fromJson matrix. Replaces the inline matrix in deploy-module-workflows.yml; both workflows now read it.
• create-module-repository.yml — registers new repos in modules.json and scaffolds the audit import so new modules ship with auditing on.

---

Note

Medium Risk
PAT-driven pushes across ~90 module dev branches can fail builds module-wide once audit props land; script errors on malformed Directory.Build.props could block deploy jobs for individual repos.

Overview
Adds central distribution of shared MSBuild build props (starting with nuget-audit.props) to all vc-module-* repos, parallel to workflow template deploys. Modules keep their own Directory.Build.props; a marker-managed <Import> block is injected or refreshed without overwriting module settings.

New pieces: common-build-props/nuget-audit.props (audit on, high+ severity, per-advisory suppress list), scripts/ensure-build-props-import.sh (copy props + inject/refresh imports; fails if Directory.Build.props is missing), and Deploy Module build props (deploy-module-build-props.yml) — matrix deploy to each module’s dev branch with archived/no-op handling.

Module list: Inline repo matrix in deploy-module-workflows.yml moves to root modules.json. Both deploy workflows use a prepare job (jq → fromJson matrix). create-module-repository.yml scaffolds audit imports for new modules and appends repos to modules.json (replacing YAML regex edits). Workflow deploy also targets dev explicitly and pushes with HEAD:dev.

Docs in README describe build-props and modules.json. Reusable workflow references bump to v3.800.41 (VCST-5372).

^{Reviewed by Cursor Bugbot for commit d72f434. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 830ff39. Configure here.}