fix(deps): clear new NuGet audit advisories (Pkcs, Cryptography.Xml, SignalR.Common)

Targeted transitive pins per the house pattern, no family-wide bump, no suppression:
Cryptography.Xml 10.0.10->10.0.13; Pkcs pinned 10.0.13 in ConfigurationDatabase,
ExternalSystemGateway, NotificationService, Playwright tests; SignalR.Common 10.0.13 in CLI.

Directory.Packages.props

@@ -45,6 +45,7 @@
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.7" />
     <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.7" />
     <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.7" />
+    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Common" Version="10.0.13" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Scripting" Version="5.0.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.0.0" />
     <PackageVersion Include="Microsoft.Data.SqlClient" Version="6.1.1" />
@@ -164,9 +165,25 @@
     (NU1605 downgrade errors) that belongs in its own reviewed commit.
   -->
   <ItemGroup>
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.10" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
   </ItemGroup>
 
+  <!--
+    2026-10-22 NuGet audit refresh (fresh restore went red under TreatWarningsAsErrors):
+      - System.Security.Cryptography.Xml 10.0.10 now carries GHSA-7hqp-7c5m-4vq6,
+        GHSA-c399-9853-6jmj, GHSA-r955-8q5j-3h83 (high): pin raised 10.0.10 -> 10.0.13.
+      - System.Security.Cryptography.Pkcs (GHSA-2fmv-rv2c-59x7 moderate, GHSA-846f-f764-76mx
+        high) reaches the graph as 9.0.4 / 10.0.0 / 10.0.10 via SqlClient 6.1.1, MimeKit and
+        System.Security.Cryptography.Xml: pinned to 10.0.13 with explicit PackageReferences in
+        ConfigurationDatabase, ExternalSystemGateway, NotificationService and the Playwright tests,
+        the projects where those chains enter.
+      - Microsoft.AspNetCore.SignalR.Common 10.0.7 (GHSA-334f-vvp4-7g6p, high) comes in
+        transitively through SignalR.Client in the CLI: pinned to 10.0.13 in the CLI only.
+    Same house pattern as above: targeted transitive pins, no family-wide servicing bump, no
+    NuGetAuditSuppress/NoWarn.
+  -->
+
   <!--
     GHSA-pgww-w46g-26qg (NU1902, moderate) on AngleSharp, reached only transitively via bunit
     in ZB.MOM.WW.ScadaBridge.CentralUI.Tests. With TreatWarningsAsErrors it made the WHOLE

src/ZB.MOM.WW.ScadaBridge.CLI/ZB.MOM.WW.ScadaBridge.CLI.csproj

@@ -12,6 +12,7 @@
   </ItemGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" />
+    <PackageReference Include="Microsoft.AspNetCore.SignalR.Common" />
     <PackageReference Include="System.CommandLine" />
   </ItemGroup>
   <ItemGroup>

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj

@@ -24,6 +24,7 @@
          10.0.7 carries four NU1903 high-severity advisories that break fresh restores
          under TreatWarningsAsErrors. See Directory.Packages.props for the rationale. -->
     <PackageReference Include="System.Security.Cryptography.Xml" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
   </ItemGroup>
 
   <ItemGroup>

src/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway.csproj

@@ -8,6 +8,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
     <PackageReference Include="Microsoft.Data.SqlClient" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Http" />

src/ZB.MOM.WW.ScadaBridge.NotificationService/ZB.MOM.WW.ScadaBridge.NotificationService.csproj

@@ -8,6 +8,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
     <PackageReference Include="MailKit" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Http" />

tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests.csproj

@@ -9,6 +9,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.Data.SqlClient" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />