fix(security): actually fix GHSA-2m69-gcr7-jv3q instead of suppressing it

The NuGetAuditSuppress in Directory.Packages.props was masking a LIVE high-severity
vulnerability, not documenting an accepted one. Only the Host project resolved a
patched SQLitePCLRaw.lib.e_sqlite3 2.1.12 (transitively, via ZB.MOM.WW.Auth.ApiKeys).
Every other SQLite consumer - AuditLog, SiteRuntime, StoreAndForward, SiteEventLogging
and 11 test projects - still resolved the vulnerable 2.1.11.

The suppression's rationale was factually wrong: it claimed 'the only patched native
lib is the SQLitePCLRaw 3.x line'. 2.1.12 patches this advisory within the 2.1.x line,
so the feared risky force-override of the whole family to 3.x is unnecessary.

Fix: explicit PackageReference to the patched 2.1.12 in each SQLite-consuming project,
plus the central PackageVersion row. Suppression removed, so the advisory is audited
again rather than silenced.

Rejected alternative: CentralPackageTransitivePinningEnabled. It clears the advisory in
one line but makes every central version a ceiling for transitive resolution, demanding
bumps to Google.Protobuf, Grpc.Net.Client, Microsoft.Data.SqlClient and Newtonsoft.Json.
That is a gRPC/data-access change to a production SCADA platform and deserves its own
reviewed commit.

Verified: forced full-solution restore reports no NU1903 (only the pre-existing,
unrelated AngleSharp NU1902 in CentralUI.Tests); all four previously-vulnerable src
projects now resolve 2.1.12; 55 projects build 0 warnings / 0 errors; 1108 tests pass
across the SQLite layer (AuditLog 354, ConfigurationDatabase 357, Security 181,
StoreAndForward 152, SiteEventLogging 64).

Directory.Packages.props

@@ -92,26 +92,35 @@
   </ItemGroup>
 
   <!--
-    Targeted NuGet audit suppression (NOT a blanket NuGetAudit=false).
-
     GHSA-2m69-gcr7-jv3q (NU1903, high) is on the NATIVE library SQLitePCLRaw.lib.e_sqlite3
     2.1.11, pulled in TRANSITIVELY by Microsoft.Data.Sqlite / EntityFrameworkCore.Sqlite.
-    The current MS-supported package line still references it: Microsoft.Data.Sqlite.Core
-    10.0.9 (latest 10.0.x as of 2026-06) declares `SQLitePCLRaw.core 2.1.11`, so a version
-    bump within the supported line does NOT clear it. The only patched native lib is the
-    SQLitePCLRaw 3.x line — force-overriding the whole SQLitePCLRaw family to 3.x under a
-    Microsoft.Data.Sqlite built and pinned for 2.1.x is unsupported and runtime-risky for the
-    entire site-local SQLite layer (S&F buffer, operation tracking, native-alarm state).
 
-    Risk assessment: SQLite here is internal, local-only storage on site nodes (+ tests); it is
-    not an externally-reachable SQL surface for untrusted input, so practical exposure is low.
-    Suppressing ONLY this advisory (auditing stays ON for everything else) lets the full
-    solution AND the docker in-container restore build cleanly without the blanket
-    `/p:NuGetAudit=false` workaround. REVISIT and remove this suppression once Microsoft.Data.Sqlite
-    ships a 10.0.x that references a patched (3.x) SQLitePCLRaw bundle.
+    FIXED PROPERLY 2026-07-18, replacing a NuGetAuditSuppress that had been masking it. The
+    suppression's stated rationale — "the only patched native lib is the SQLitePCLRaw 3.x line" —
+    was WRONG: 2.1.12 patches this advisory within the 2.1.x line, so no risky force-override of
+    the whole family to 3.x is needed. Verified empirically: with the suppression removed and the
+    pin in place, a forced restore reports no NU1903.
+
+    Why the pin and not a Microsoft.Data.Sqlite bump: bumping Sqlite does NOT clear it (even
+    10.0.10 still references 2.1.11). Pinning the native lib is the fix. Same approach as
+    ZB.MOM.WW.Secrets and ZB.MOM.WW.LocalDb.
+
+    Why this mattered more than it looked: only the Host project resolved a patched 2.1.12 (via
+    ZB.MOM.WW.Auth.ApiKeys). AuditLog, SiteEventLogging, SiteRuntime, StoreAndForward and the
+    test projects — the whole site-local SQLite layer — were still resolving the vulnerable
+    2.1.11, and the suppression hid that everywhere.
+
+    Delivered as an explicit <PackageReference> in each SQLite-consuming project rather than via
+    CentralPackageTransitivePinningEnabled. Enabling transitive pinning globally was tried first
+    and rejected: it makes every centrally-defined version a hard ceiling for transitive
+    resolution too, which immediately demanded bumps to Google.Protobuf (3.29.3->3.34.1),
+    Grpc.Net.Client (2.71.0->2.76.0), Microsoft.Data.SqlClient (6.0.2->6.1.1) and Newtonsoft.Json
+    (13.0.3->13.0.4). Those may well be worth doing, but they are a gRPC/data-access change to a
+    production SCADA platform and belong in their own reviewed commit — not smuggled in under a
+    SQLite security fix.
   -->
   <ItemGroup>
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
+    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
   </ItemGroup>
 
 </Project>