.NET deps.json should be considered as installation evidence

[wagoodman]

There is discussion in #3176 regarding what the correct cataloger to use for the example image. However, the deps.json is compiler output and really should be considered as installed evidence (today we only consider it as declared evidence).

We should most likely merge the PE-binary cataloger and the deps.json cataloger into one, where we only parse PE binaries that do not already have representation in a deps.json file. This would be an installed-type cataloger and run for both dir and image scans.

Note on compatibility: to not break existing users we need to add a third cataloger that does this merging behavior and fix the tags for the existing catalogers so they are not run by default.