Add configurable transport security profiles and bind address

Adds Security section to appsettings.json with configurable OPC UA
transport profiles (None, Basic256Sha256-Sign, Basic256Sha256-SignAndEncrypt),
certificate policy settings, and a configurable BindAddress for the
OPC UA endpoint. Defaults preserve backward compatibility.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.LmxOpcUa.Host/Configuration/SecurityProfileConfiguration.cs

@@ -0,0 +1,45 @@
+using System.Collections.Generic;
+
+namespace ZB.MOM.WW.LmxOpcUa.Host.Configuration
+{
+    /// <summary>
+    /// Transport security settings that control which OPC UA security profiles the server exposes and how client certificates are handled.
+    /// </summary>
+    public class SecurityProfileConfiguration
+    {
+        /// <summary>
+        /// Gets or sets the list of security profile names to expose as server endpoints.
+        /// Valid values: "None", "Basic256Sha256-Sign", "Basic256Sha256-SignAndEncrypt".
+        /// Defaults to ["None"] for backward compatibility.
+        /// </summary>
+        public List<string> Profiles { get; set; } = new List<string> { "None" };
+
+        /// <summary>
+        /// Gets or sets a value indicating whether the server automatically accepts client certificates
+        /// that are not in the trusted store. Should be <see langword="false"/> in production.
+        /// </summary>
+        public bool AutoAcceptClientCertificates { get; set; } = true;
+
+        /// <summary>
+        /// Gets or sets a value indicating whether client certificates signed with SHA-1 are rejected.
+        /// </summary>
+        public bool RejectSHA1Certificates { get; set; } = true;
+
+        /// <summary>
+        /// Gets or sets the minimum RSA key size required for client certificates.
+        /// </summary>
+        public int MinimumCertificateKeySize { get; set; } = 2048;
+
+        /// <summary>
+        /// Gets or sets an optional override for the PKI root directory.
+        /// When <see langword="null"/>, defaults to <c>%LOCALAPPDATA%\OPC Foundation\pki</c>.
+        /// </summary>
+        public string? PkiRootPath { get; set; }
+
+        /// <summary>
+        /// Gets or sets an optional override for the server certificate subject name.
+        /// When <see langword="null"/>, defaults to <c>CN={ServerName}, O=ZB MOM, DC=localhost</c>.
+        /// </summary>
+        public string? CertificateSubject { get; set; }
+    }
+}