Add ability to optionally ignore dev dependencies in Paket projects

Release notes

TODO

Problem to solve

After Support Paket lock files in Dependency Scanning (#381904), Paket projects will parse both non-dev and dev packages in the lockfiles. To make Paket projects behave consistently with the DS_INCLUDE_DEV_DEPENDENCIES flag, it should only include dev dependencies when the CI variable has been set to true.

Proposal

Parse the paket.dependencies and/or paket.references files so that the groups are parsed and used when building the dependency graph. If the dependency group are set and not using a common name for production dependencies e.g. Production, Default, Build etc. then they should be excluded when walking the dependency graph and generating a report/SBoM artifact.

Feature Usage Metrics