docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.Security/RoleMapper.cs

@@ -13,7 +13,7 @@ public class RoleMapper
         _securityRepository = securityRepository ?? throw new ArgumentNullException(nameof(securityRepository));
     }
 
-    // virtual: a test seam so HTTP-pipeline tests (e.g. the #23 M8 audit
+    // virtual: a test seam so HTTP-pipeline tests (e.g. the audit
     // endpoints) can substitute the LDAP-group→role resolution.
     /// <summary>Maps a list of LDAP group names to ScadaBridge roles and computes site-scope permissions.</summary>
     /// <param name="ldapGroups">LDAP group names from the authenticated user's directory entry.</param>
@@ -59,7 +59,7 @@ public class RoleMapper
             }
         }
 
-        // Union semantics (Security-016): a Deployment user is system-wide iff
+        // Union semantics: a Deployment user is system-wide iff
         // *any* matched Deployment mapping has no scope rules. A user in both
         // SCADA-Deploy-All (unscoped) and SCADA-Deploy-SiteA (scoped to Site A)
         // gets the broader grant, not the narrower one — matching the design's