restrict when we add binding redirects

[brettfo]

Previously when updating a package in a packages.config scenario with an app.config file, we'd update or add binding redirects for all referenced assemblies. This was too heavy-handed, particularly when a user's app.config file only had a few binding redirects. We'd then add 20+ which wasn't really what they wanted.

Another approach would be to only update existing binding redirects, but ultimately the dependabot tool is meant to help address security vulnerabilities, which might mean updating a very specific transitive dependency and if a binding redirect wasn't added, this could lead to difficult to diagnose issues at runtime with an assembly mismatch.

So the approach taken here is twofold: (1) update any existing binding redirect, and (2) add new binding redirects, but only for the updated package.

This can look complex, but it's not too bad. A NuGet package can contain assemblies with any name, they don't have to match the name of the package, but thankfully all packages are extracted to a well-known location so to do the binding redirects, we simply look for all assemblies under that very specific path.