fix(build): pin dep for clear audit

[sicoyle]

PR description
dotnet restore fails on master with NU1902: Package 'Microsoft.Build.Tasks.Git' 10.0.300 has a known moderate severity vulnerability (GHSA-23fw-v26w-5fgq), which TreatWarningsAsErrors turns into a hard restore failure for both packable projects. Since the restore step gates every downstream job, nothing builds, tests, packs or publishes until this clears — including the v1.2.0 release.

The earlier bump of Microsoft.SourceLink.GitHub to 10.0.401 was correct but incomplete. SourceLink 10.0.401 does ask for Build.Tasks.Git 10.0.401, but that package also arrives from the SDK itself at 10.0.300, and since nothing in this repo references it directly there was no PackageVersion entry for central transitive pinning to raise. This adds one, in lockstep with the SourceLink pin it belongs to.

This is also why the failure is CI-only and did not reproduce locally: global.json sets rollForward: latestFeature, so CI rolls from the declared 10.0.100 up to SDK 10.0.401, and it is that band which contributes the vulnerable 10.0.300. A local 10.0.1xx SDK never sees it.

Per the advisory, 10.0.300–10.0.301 are affected with 10.0.303 the first patched release in that band; the 10.0.4xx band is unaffected. Pinning to 10.0.401 rather than 10.0.303 keeps the two SourceLink-related packages on the same version.

Verification

Pinning to a deliberately different version confirms the central entry actually governs resolution rather than merely agreeing with it:

• pin 10.0.303 → dotnet nuget why resolves Microsoft.Build.Tasks.Git (v10.0.303)
• pin 10.0.401 → resolves Microsoft.Build.Tasks.Git (v10.0.401)

Then, with the pin at 10.0.401: dotnet restore reports zero NU1902/NU1903 audit errors, dotnet build -c Release succeeds with 0 warnings and 0 errors, the identity tests pass 131/131 on each of net8.0, net9.0 and net10.0, and dotnet pack produces all four packages.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.