Additional-deps feature doesn't work with roll-forward

[steveharter]

The feature to add additional deps via the DOTNET_ADDITIONAL_DEPS environment variable or --additional-deps argument is not working with roll-forward.

Steps to reproduce

• Create the folder c:\ReproDepsIssue\shared\Microsoft.NETCore.App\2.0.0
• Create the folder c:\ReproDepsIssue\shared\Microsoft.NETCore.App\2.0.1
• Add a foo.deps.json file in both folders (it can be empty for repro)
• Set DOTNET_ADDITIONAL_DEPS=c:\ReproDepsIssue
• Set COREHOST=TRACE=1
• Run an app that targets 2.0.0 but finds 2.0.1 (due to roll-forward)

Expected behavior

The trace output contains Using specified additional deps.json: 'c:\ReproDepsIssue\shared\Microsoft.NETCore.App\2.0.1\foo.deps.json' and the additional deps information is added

Actual behavior

The trace output contains Using specified additional deps.json: 'c:\ReproDepsIssue\shared\Microsoft.NETCore.App\2.0.0\foo.deps.json'

Meaning it did not roll-forward

Notes

The bug is here: https://github.com/dotnet/core-setup/blob/release/2.0.0/src/corehost/cli/deps_resolver.cpp#L525 fx_ver is the requested version, not the found version.

The bug was found when converting the code to support multi-layer and is fixed there. A couple weeks later @davidfowl found the issue affecting asp.net.

However, the issue should not be fixed in 2.0.x immediately, because the deps.json files that asp.net is using for already patched versions are broken.

The best time to add the fix may be when the layered framework code is ported to 2.0.x for LTS and after asp.net can fix up their deps.json files.

[vitek-karas]

Needs at the very least to add a test (one way or another).