Scope the product EOL date to repos

[mthalman]

The logic which computes the EOL annotations that need to be applied has an option for querying the .NET releases JSON file to determine the EOL dates of .NET versions:

docker-tools/src/Microsoft.DotNet.ImageBuilder/src/Commands/GenerateEolAnnotationDataCommand.cs

Lines 128 to 140 in 5c9606d

	if (Options.AnnotateEolProducts)
	{
	// Annotate images for EOL products in new image info
	// Only do so for those digests that actually exist in the registry (they may have been cleaned up
	// because they are EOL).
	IEnumerable<EolDigestData> eolDigests =
	newImageArtifactDetails.Repos
	.SelectMany(repo =>
	repo.Images
	.SelectMany(image => GetProductEolDigests(image, productEolDates)))
	.Where(digestData => registryTagsByDigest.ContainsKey(digestData.Digest));
	digestDataList.AddRange(eolDigests);
	}

It associates those dates with the Dockerfiles having the same .NET version. This is fine for the core repos like runtime, aspnet, and sdk because the images in those repos follow the same versioning as the main .NET product. But in cases like YARP which have their own separate versioning, it's not applicable. There is danger of those versions matching an EOL .NET version and having those images incorrectly annotated as EOL when they're not.

So there's a need to be able to scope the product EOL date to specific repos so that it won't match on other repos where those dates aren't applicable.

[lbussell]

[Triage] There is little value in investing in this infrastructure if we make the decision to remove the EOL product logic from the vulnerability tooling. see dotnet/dotnet-docker#6157 for the related policy change.

[lbussell]

[Triage] We had a discussion about when/how to set EOL annotations for EOL .NET products. We should just set the EOL annotations when images are removed from the repo. If we do this, then we can:

• Remove code for EOL based on releases.json
• Avoid specialization for Appliance images
• Remove EOL images day-of or next-day (after a final product version release)

[mthalman]

Closing this since it's no longer relevant. This logic will be removed by #1581.