build: pin patched System.Security.Cryptography.* / SignalR to clear fresh-restore NuGet audit

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/ZB.MOM.WW.OtOpcUa.Configuration.csproj

@@ -28,6 +28,10 @@
              Directory.Packages.props. This is the one project where the DataProtection chain
              enters the repo; every other consumer reaches it through a ProjectReference here. -->
         <PackageReference Include="System.Security.Cryptography.Xml"/>
+        <!-- Surgical transitive pin — see the System.Security.Cryptography.Pkcs block in
+             Directory.Packages.props. Microsoft.Data.SqlClient (via EFCore.SqlServer) enters here
+             too and pulls a vulnerable Pkcs 9.0.4 wherever the shared framework prunes the Xml chain. -->
+        <PackageReference Include="System.Security.Cryptography.Pkcs"/>
         <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions"/>
         <PackageReference Include="Microsoft.Extensions.Logging.Abstractions"/>
         <PackageReference Include="Polly.Core"/>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect.csproj

@@ -26,6 +26,10 @@
          provider's DbProviderFactory (NpgsqlFactory / OracleClientFactory); both packages are fully
          managed ADO.NET drivers, so adding them costs no native client install anywhere. -->
     <PackageReference Include="Microsoft.Data.SqlClient" />
+    <!-- Surgical transitive pin — see the System.Security.Cryptography.Pkcs block in
+         Directory.Packages.props. SqlClient 6.1.1 pulls a vulnerable Pkcs 9.0.4; this is the
+         second place the SqlClient chain enters the repo (Core.Configuration is the first). -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" />
     <PackageReference Include="Npgsql" />
     <PackageReference Include="Oracle.ManagedDataAccess.Core" />
   </ItemGroup>

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ZB.MOM.WW.OtOpcUa.AdminUI.csproj

@@ -9,6 +9,12 @@
     <ItemGroup>
         <FrameworkReference Include="Microsoft.AspNetCore.App"/>
         <PackageReference Include="Microsoft.AspNetCore.SignalR.Client"/>
+        <!-- Surgical transitive pin — see the Microsoft.AspNetCore.SignalR.Common block in
+             Directory.Packages.props (GHSA-334f-vvp4-7g6p on SignalR.Common 10.0.0). Inside AdminUI
+             the shared framework already supplies it (hence NU1510), but the PackageReference flows
+             to the non-Web consumers (Host.Tests, AdminUI.Tests, OpcUaServer.IntegrationTests) where
+             SignalR.Client 10.0.0 would otherwise resolve the vulnerable 10.0.0. -->
+        <PackageReference Include="Microsoft.AspNetCore.SignalR.Common" NoWarn="NU1510"/>
         <PackageReference Include="ZB.MOM.WW.Theme"/>
         <PackageReference Include="ZB.MOM.WW.Secrets.Ui"/>
     </ItemGroup>