PMUI package vulnerability service improvements

[Nigusu-Allehu]

• The package vulnerability service is currently called on Vs shutdown cancellation token. We should use a cancellation token that cancels when the refresh button is clicked
• The service only refreshes when the refresh button is clicked. Consider the situation where the PMUI has been open for a long time and the refresh button was never clicked. Maybe we should refresh every time the vulnerability cache files expire and are reloaded.
• PackageManagerControl.xaml.cs has an async call to GetVulnerabilityInfoAsync per package. Reduce the unnecessary async calls by adding a method to the package vulnerability service that takes in a collection of packages and makes one async call to get the vulnerability data