Add configurable transport security profiles and bind address

Adds Security section to appsettings.json with configurable OPC UA
transport profiles (None, Basic256Sha256-Sign, Basic256Sha256-SignAndEncrypt),
certificate policy settings, and a configurable BindAddress for the
OPC UA endpoint. Defaults preserve backward compatibility.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/ZB.MOM.WW.LmxOpcUa.Tests/Helpers/OpcUaServerFixture.cs

@@ -2,6 +2,7 @@ using System.Threading;
 using System.Threading.Tasks;
 using Xunit;
 using ZB.MOM.WW.LmxOpcUa.Host;
+using ZB.MOM.WW.LmxOpcUa.Host.Configuration;
 
 namespace ZB.MOM.WW.LmxOpcUa.Tests.Helpers
 {
@@ -108,10 +109,12 @@ namespace ZB.MOM.WW.LmxOpcUa.Tests.Helpers
         /// </summary>
         /// <param name="mxClient">An optional fake MXAccess client to inject; otherwise a default fake is created.</param>
         /// <param name="repo">An optional fake repository to inject; otherwise standard test data is used.</param>
+        /// <param name="security">An optional security profile configuration for the test server.</param>
         /// <returns>A fixture configured to exercise the direct fake-client path.</returns>
         public static OpcUaServerFixture WithFakeMxAccessClient(
             FakeMxAccessClient? mxClient = null,
-            FakeGalaxyRepository? repo = null)
+            FakeGalaxyRepository? repo = null,
+            SecurityProfileConfiguration? security = null)
         {
             var client = mxClient ?? new FakeMxAccessClient();
             var r = repo ?? new FakeGalaxyRepository
@@ -125,6 +128,9 @@ namespace ZB.MOM.WW.LmxOpcUa.Tests.Helpers
                 .WithGalaxyRepository(r)
                 .WithGalaxyName("TestGalaxy");
 
+            if (security != null)
+                builder.WithSecurity(security);
+
             return new OpcUaServerFixture(builder, repo: r, mxClient: client);
         }