feat(dcl): move the OPC UA client to OPC Foundation SDK 2.0.1 (#125)

OPCFoundation.NetStandard.Opc.Ua.Client and the test-only .Server move
1.5.378.182 -> 2.0.1, the version OtOpcUa master runs (lmxopcua#782; #799
and #801 closed). Transitive Core/Core.Types/Types/Configuration/
Security.Certificates resolve to 2.0.1.

API breaks fixed in the DCL adapter:
- Built-in types are immutable structs (Variant, DataValue, NodeId,
  LocalizedText, StatusCode, ArrayOf<T>). New OpcUaValueBoundary restores
  the SDK 1.5 CLR shapes for every read, subscription and alarm-event
  value (byte[], UTC DateTime with no-timestamp = MinValue, Guid,
  detached arrays) and builds write variants with SDK 1.5's
  new Variant(object) semantics (byte[] = ByteString scalar).
- StatusCodes members are no longer constants: switches/patterns over
  them (verify-outcome mapping, connection-level classification,
  BadResourceUnavailable) match by value.
- CertificateIdentifier no longer caches a certificate and the
  CertificateValidator/CertificateValidation event is gone: the
  configuration's CertificateManager owns trust lists and the loaded
  application certificate and is disposed with the session; auto-accept
  and the verify probe's capture-and-reject use AcceptError.
- new UserIdentity(X509Certificate2) is gone: X509 user identities use
  X509IdentityTokenHandler with an on-demand PFX provider (still fails
  fast on a missing file/key).
- DefaultSessionFactory takes the telemetry context; collections are
  ArrayOf<T>; EventFilter select clauses and ContentFilter operands are
  built immutably.

UserName identity (lmxopcua#880): SDK 2's default handler sends a
password over 64 bytes - every 65-character OtOpcUa API key - as an
RsaEncryptedSecret that SDK 1.5 servers reject with BadIdentityTokenInvalid
and SDK 2 servers accept only within a 5-minute clock window (#873). The
DCL now always uses LegacyRsaUserNameIdentityTokenHandler (ported from
OtOpcUa be28aa44), i.e. exactly what it sent on SDK 1.5, so it logs in to
both server generations during a mixed rollout.

Tests: the in-process secured test server is ported to SDK 2 and can
admit an API key; new tests cover the handler (mutation-checked: 5 of 7
fail with the SDK default handler), the value boundary, and a 65-char key
end to end over None/Sign/SignAndEncrypt with a wrong key reaching the
key check (BadIdentityTokenRejected).

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

docs/requirements/Component-DataConnectionLayer.md

@@ -70,7 +70,10 @@ All protocols produce the same value tuple consumed by Instance Actors. Before t
 ## Supported Protocols
 
 ### OPC UA
-- Uses the **OPC Foundation .NET Standard Library** (`OPCFoundation.NetStandard.Opc.Ua.Client`).
+- Uses the **OPC Foundation .NET Standard Library** (`OPCFoundation.NetStandard.Opc.Ua.Client`), **SDK 2.0.1** since ScadaBridge#125 (2026-11-12; the same version OtOpcUa runs). The port keeps the SDK 1.5 behaviour at the adapter boundary:
+  - **Values.** SDK 2's `Variant`/`DataValue` are immutable structs and its boxing returns SDK wrapper types; `OpcUaValueBoundary` converts every read, subscription and alarm-event value back to the SDK 1.5 CLR shapes (`byte[]` for ByteString, UTC `DateTime` with "no timestamp" as `DateTime.MinValue`, `Guid`, detached arrays), and builds write variants with SDK 1.5's `new Variant(object)` semantics (a `byte[]` is a ByteString scalar).
+  - **UserName identity.** Always sent in the legacy RSA password format (`LegacyRsaUserNameIdentityTokenHandler`, ported from OtOpcUa lmxopcua#880). SDK 2's own handler sends a password over 64 bytes — every 65-character OtOpcUa API key — as an `RsaEncryptedSecret`, which an SDK 1.5 server rejects with `BadIdentityTokenInvalid` and an SDK 2 server accepts only within a 5-minute clock window (lmxopcua#873). With the legacy format the DCL logs in to both server generations, as it did on SDK 1.5. X509 user identities resolve the PFX's private key on demand (`OpcUaUserIdentities`); a missing file or key still fails before any session is created.
+  - **Certificates.** The configuration's SDK-created `CertificateManager` owns the trust lists and the loaded application certificate, and is disposed with the session. `AutoAcceptUntrustedCerts` and the verify probe's capture-and-reject use the manager's `AcceptError` hook (the 1.5 `CertificateValidation` event is gone). SDK 2 makes two errors non-suppressible even with auto-accept on: an incomplete chain (install the issuing CA in the trusted or issuer store) and a certificate with an empty subject or issuer.
 - Session-based connection with endpoint discovery, certificate handling, and configurable security modes. Endpoint discovery is **asynchronous** and bounded by the connection's `OperationTimeoutMs` (the discovery client is built from the connection's own `EndpointConfiguration`) and by the caller's cancellation; a cancelled discovery is never mistaken for "discovery unavailable". The `DataConnectionActor` starts every adapter `ConnectAsync` on the thread pool, so no adapter connect work — whatever runs before its first yielding await — can occupy the actor's dispatcher thread (review 2026-10-21; previously a synchronous discovery against a black-holed endpoint held the thread for the SDK's 120 s default on every reconnect tick).
 - Subscriptions via OPC UA Monitored Items with data change notifications (1000ms sampling, queue size 10, discard-oldest).
 - Read/Write via OPC UA Read/Write services with StatusCode-based quality mapping.