Add transitive NuGet vulnerability auditing to CI

[Widthdom]

Summary

CI does not currently expose a dedicated gate for vulnerabilities in direct and transitive NuGet dependencies. At the time of review, no listed vulnerability was found in the shipped application projects, but the test project’s FsCheck.Xunit dependency chain contained outdated transitive packages with High-severity advisories.

Proposed approach

• Run dotnet list package --vulnerable --include-transitive or an equivalent audit across the full solution in CI.
• Include both product and test projects.
• Upgrade the affected FsCheck.Xunit dependency chain to a safe, compatible version.
• Fail CI when High/Critical vulnerabilities are detected.
• Publish the audit result in the Actions log or job summary.
• Any temporary exception must document the advisory, rationale, affected scope, and expiry date.

Scope note

The currently observed finding is in test dependencies rather than the distributed runtime. Test and CI dependencies are still part of the repository supply chain and should remain visible and auditable.

Acceptance criteria

• CI audits direct and transitive NuGet dependencies for every project.
• The currently observed High-severity transitive finding is remediated.
• Newly introduced High/Critical vulnerabilities fail CI.
• A documented command reproduces the same audit locally.