[MartinHock]

Summary

• Pin System.Security.Cryptography.Pkcs to 10.0.13 in the root, MinimalClean, and sample dependency graphs.
• Update the root MessagePack pin from 3.1.8 to 3.1.12.
• Pin MessagePack 2.5.303 in the nested MinimalClean and sample Aspire graphs.
• Update root Testcontainers and Testcontainers.MsSql from 4.13.0 to 4.14.0 so the root graph no longer resolves vulnerable SSH.NET 2025.1.0.
• Enable central transitive pinning in MinimalClean and sample.
• Align the stale sample Azure.Identity / Microsoft.Extensions.* central versions required once transitive pinning is enabled.
• Add independent Dependabot NuGet coverage for /MinimalClean and /sample.
• Ensure the existing required workflow contexts are triggered by nested dependency/config changes.

Fixes #1096.

Scope

This intentionally does not duplicate:

• Warnigs as errors: NU1903 for sqlitePCLTRaw package #1066 for the existing SQLitePCLRaw.lib.e_sqlite3 advisory.
• Group Dependabot non-major NuGet updates #1093 for Dependabot grouping policy. This PR only adds the two missing nested NuGet scopes; it does not introduce grouping.

The two root Testcontainers updates are the same dependency changes already proposed by Dependabot in #1081. They are included here because the vulnerable transitive SSH.NET 2025.1.0 otherwise makes every root restore fail with NU1903, leaving this security-remediation PR permanently red.

Validation

Validation was performed from a clean worktree based on current upstream main (e7c79be54ba0b001a5b332c1efe935f520b9db4b).

Vulnerability audit after the change

• Root solution: no vulnerable packages reported.
• MinimalClean: no vulnerable packages reported.
• sample: the Pkcs and MessagePack findings are gone; only the separately tracked SQLitePCLRaw.lib.e_sqlite3 2.1.11 finding and the sample graph's existing SSH.NET 2025.1.0 finding remain.

Build / tests

• Root restore with normal warnings-as-errors policy: success.
• Root Release build: 0 warnings, 0 errors.
• MinimalClean Release build: 0 warnings, 0 errors.
• sample Release build: success, 0 errors; existing SQLite RID/security warnings remain outside this PR's scope.
• Root unit tests: 12 passed.
• Root integration tests after the Testcontainers update: 4 passed.
• Root functional tests after the Testcontainers update: 4 passed.
• Sample unit tests: 30 passed.
• git diff --check: clean.

The local machine currently selects an installed .NET 11 RC SDK for these net10 projects; GitHub Actions continues to use the workflow-pinned .NET 10.0.x SDK.