perf(@angular/cli): avoid redundant package version resolution in ng add

[clydin]

The ng add command would previously resolve the package version from the registry multiple times during execution. This change updates the package identifier with the exact version from the manifest once it has been fetched from the registry, preventing subsequent redundant lookups. Additionally, the already-parsed package identifier is now passed directly to the package manager's getManifest method.

[gemini-code-assist]

Code Review

This pull request optimizes the ng add command by preventing redundant package version resolutions, ensuring subsequent operations use the exact resolved version and eliminating unnecessary registry lookups. However, the current implementation introduces a security risk by trusting the name and version fields from the package manifest to update the package identifier. This could lead to package substitution or path traversal attacks if a malicious manifest is provided. A validation check is required to ensure the manifest data aligns with the requested package.

[clydin]

This PR was merged into the repository. The changes were merged into the following branches:

• main: ad0fd5f
• 21.2.x: 28f4d68

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}