Address detected binaries in the VMR

[premun]

Context

The binary scan now shows this:

src/aspnetcore/src/SignalR/clients/java/signalr/gradle/wrapper/gradle-wrapper.jar
src/roslyn/src/ExpressionEvaluator/Core/Source/ExpressionCompiler/Resources/WindowsProxy.winmd
src/runtime/src/libraries/System.Speech/src/upstable_chs.upsmap
src/runtime/src/libraries/System.Speech/src/upstable_cht.upsmap
src/runtime/src/libraries/System.Speech/src/upstable_deu.upsmap
src/runtime/src/libraries/System.Speech/src/upstable_enu.upsmap
src/runtime/src/libraries/System.Speech/src/upstable_esp.upsmap
src/runtime/src/libraries/System.Speech/src/upstable_fra.upsmap
src/runtime/src/libraries/System.Speech/src/upstable_jpn.upsmap
src/runtime/src/libraries/System.Text.Encoding.CodePages/src/Data/codepages.nlp
src/runtime/src/mono/wasm/runtime/do-jit-call.wasm

For each of those, we need to either:

• Suppress it in the scan by adding it in the baseline
• Cloak it in source-mappings.json and remove from the VMR

Detected binaries

gradle-wrapper.jar in SignalR

• [x] dotnet/arcade#12448

WindowsProxy.winmd in roslyn

• [ ] https://github.com/dotnet/roslyn/issues/66718

.upsmap files in System.Speech

• [ ] https://github.com/dotnet/runtime/issues/81692

codepages.nlp

• [ ] https://github.com/dotnet/runtime/issues/81693

do-jit-call.wasm

• [x] https://github.com/dotnet/runtime/issues/81691

[tkapin]

What needs to happen to unblock this?

[premun]

This is tracking

[tkapin]

We need better way to distinguish those, I don't think blocked and tracking should be mixed.

[tkapin]

The teams still need to do this, we will probably have to push them as it's low priority work for them.