build: suppress NU1903 for CVE-2025-6965 (SQLitePCLRaw, no upstream fix)

Transitive native bundle SQLitePCLRaw.lib.e_sqlite3 (via Microsoft.Data.Sqlite ->
Core.AlarmHistorian) is flagged by GHSA-2m69-gcr7-jv3q with no patched package yet
published. Add the documented NuGetAuditSuppress so the solution restores/builds;
remove once a patched SQLitePCLRaw bundle ships. Incidental to the code-review pass.

Directory.Build.props

@@ -15,4 +15,19 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <LangVersion>latest</LangVersion>
   </PropertyGroup>
+
+  <!--
+    NuGet audit suppression: CVE-2025-6965 / GHSA-2m69-gcr7-jv3q affects the transitive native
+    bundle SQLitePCLRaw.lib.e_sqlite3 (advisory range <= 2.1.11), pulled in via
+    Microsoft.Data.Sqlite 9.0.0 -> SQLitePCLRaw.bundle_e_sqlite3 by Core.AlarmHistorian's
+    store-and-forward sink. As of 2026-06-20 the maintainer has NOT shipped a patched bundle
+    (SQLite fixed the underlying flaw upstream in 3.50.2 but no SQLitePCLRaw release embeds it
+    yet), so there is no package version to bump to. The flaw requires attacker-controlled
+    pathological aggregate SQL; the sink only issues internal parameterised statements, so the
+    exposure here is negligible. REMOVE this suppression once SQLitePCLRaw ships a patched native
+    bundle and bump Microsoft.Data.Sqlite to a release that references it.
+  -->
+  <ItemGroup>
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
+  </ItemGroup>
 </Project>