fix(ci): corrigir workflows legados

[devin-ai-integration]

All Submissions:

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes to Core Features:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your core changes, as applicable?
• Have you successfully ran tests with your changes locally?

Summary

This extends Fase 5 to fix the pre-existing workflow bugs called out in review and CI:

• corrects the SonarCloud project key in the security workflows to afonsoft_QRCoder.Core
• replaces the copied dependency-update logic with a JSON-driven updater that targets the real project files in this repo
• changes the CI auto-PR branch from main to a dedicated auto-pr/<branch> name so the create-pull-request job no longer tries to push/delete main
• keeps the earlier security hardening from the previous commit set

Validation:

• dotnet build QRCoder.Core.sln ✅
• VSTEST_CONNECTION_TIMEOUT=600 dotnet test QRCoder.Core.sln ✅ for net8.0 and net10.0
• net48 still has 2 known renderer hash failures in this environment

Link to Devin session: https://app.devin.ai/sessions/c65e59fa11ca445bad5804221a77eed7
Requested by: @afonsoft

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud