feat(dcl): move the OPC UA client to OPC Foundation SDK 2.0.1 (#125)

OPCFoundation.NetStandard.Opc.Ua.Client and the test-only .Server move
1.5.378.182 -> 2.0.1, the version OtOpcUa master runs (lmxopcua#782; #799
and #801 closed). Transitive Core/Core.Types/Types/Configuration/
Security.Certificates resolve to 2.0.1.

API breaks fixed in the DCL adapter:
- Built-in types are immutable structs (Variant, DataValue, NodeId,
  LocalizedText, StatusCode, ArrayOf<T>). New OpcUaValueBoundary restores
  the SDK 1.5 CLR shapes for every read, subscription and alarm-event
  value (byte[], UTC DateTime with no-timestamp = MinValue, Guid,
  detached arrays) and builds write variants with SDK 1.5's
  new Variant(object) semantics (byte[] = ByteString scalar).
- StatusCodes members are no longer constants: switches/patterns over
  them (verify-outcome mapping, connection-level classification,
  BadResourceUnavailable) match by value.
- CertificateIdentifier no longer caches a certificate and the
  CertificateValidator/CertificateValidation event is gone: the
  configuration's CertificateManager owns trust lists and the loaded
  application certificate and is disposed with the session; auto-accept
  and the verify probe's capture-and-reject use AcceptError.
- new UserIdentity(X509Certificate2) is gone: X509 user identities use
  X509IdentityTokenHandler with an on-demand PFX provider (still fails
  fast on a missing file/key).
- DefaultSessionFactory takes the telemetry context; collections are
  ArrayOf<T>; EventFilter select clauses and ContentFilter operands are
  built immutably.

UserName identity (lmxopcua#880): SDK 2's default handler sends a
password over 64 bytes - every 65-character OtOpcUa API key - as an
RsaEncryptedSecret that SDK 1.5 servers reject with BadIdentityTokenInvalid
and SDK 2 servers accept only within a 5-minute clock window (#873). The
DCL now always uses LegacyRsaUserNameIdentityTokenHandler (ported from
OtOpcUa be28aa44), i.e. exactly what it sent on SDK 1.5, so it logs in to
both server generations during a mixed rollout.

Tests: the in-process secured test server is ported to SDK 2 and can
admit an API key; new tests cover the handler (mutation-checked: 5 of 7
fail with the SDK default handler), the value boundary, and a 65-char key
end to end over None/Sign/SignAndEncrypt with a wrong key reaching the
key check (BadIdentityTokenRejected).

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

tests/ZB.MOM.WW.ScadaBridge.DataConnectionLayer.Tests/VerifyEndpointResultMappingTests.cs

@@ -109,12 +109,12 @@ public class VerifyEndpointResultMappingTests
     /// <summary>Verifies that ServiceResultException authentication status codes map to an auth-failed result.</summary>
     /// <param name="statusCode">The status code.</param>
     [Theory]
-    [InlineData(StatusCodes.BadUserAccessDenied)]
-    [InlineData(StatusCodes.BadIdentityTokenRejected)]
-    [InlineData(StatusCodes.BadIdentityTokenInvalid)]
-    public void ServiceResultException_AuthCodes_MapToAuthFailed(uint statusCode)
+    [InlineData(nameof(StatusCodes.BadUserAccessDenied))]
+    [InlineData(nameof(StatusCodes.BadIdentityTokenRejected))]
+    [InlineData(nameof(StatusCodes.BadIdentityTokenInvalid))]
+    public void ServiceResultException_AuthCodes_MapToAuthFailed(string statusCode)
     {
-        var ex = new ServiceResultException(statusCode, "access denied");
+        var ex = new ServiceResultException(Status(statusCode), "access denied");
 
         var result = RealOpcUaClient.MapVerifyOutcome(ex, null);
 
@@ -126,11 +126,11 @@ public class VerifyEndpointResultMappingTests
     /// <summary>Verifies that ServiceResultException connection status codes map to an unreachable result.</summary>
     /// <param name="statusCode">The status code.</param>
     [Theory]
-    [InlineData(StatusCodes.BadConnectionRejected)]
-    [InlineData(StatusCodes.BadNotConnected)]
-    public void ServiceResultException_ConnectionCodes_MapToUnreachable(uint statusCode)
+    [InlineData(nameof(StatusCodes.BadConnectionRejected))]
+    [InlineData(nameof(StatusCodes.BadNotConnected))]
+    public void ServiceResultException_ConnectionCodes_MapToUnreachable(string statusCode)
     {
-        var ex = new ServiceResultException(statusCode, "no route");
+        var ex = new ServiceResultException(Status(statusCode), "no route");
 
         var result = RealOpcUaClient.MapVerifyOutcome(ex, null);
 
@@ -138,6 +138,11 @@ public class VerifyEndpointResultMappingTests
         Assert.Equal(VerifyFailureKind.Unreachable, result.FailureKind);
     }
 
+    // SDK 2 (ScadaBridge#125): StatusCodes members are StatusCode structs, not constants, so the
+    // theories name them and resolve the value here.
+    private static StatusCode Status(string name) =>
+        (StatusCode)typeof(StatusCodes).GetField(name)!.GetValue(null)!;
+
     /// <summary>Verifies that a socket exception maps to an unreachable result.</summary>
     [Fact]
     public void SocketException_MapsToUnreachable()