Transitive dependencies have high/critical security vulnerabilities

[jskeet]

From running dotnet list package --vulnerable --include-transitive in CloudNative.CloudEvents.AspNetCore:

Project `CloudNative.CloudEvents.AspNetCore` has the following vulnerable packages
   [netstandard2.0]:
   Transitive Package               Resolved   Severity   Advisory URL
   > Newtonsoft.Json                9.0.1      High       https://github.com/advisories/GHSA-5crp-9r3c-p9vr
   > System.Text.Encodings.Web      4.5.0      Critical   https://github.com/advisories/GHSA-ghhp-997w-qr28

   [netstandard2.1]:
   Transitive Package               Resolved   Severity   Advisory URL
   > Newtonsoft.Json                9.0.1      High       https://github.com/advisories/GHSA-5crp-9r3c-p9vr
   > System.Text.Encodings.Web      4.5.0      Critical   https://github.com/advisories/GHSA-ghhp-997w-qr28

Both of these come from Microsoft.Extensions.DependencyModel 2.1.0. There's no upgrade in the 2.x line for this. We could potentially upgrade just Newtonsoft.Json and System.Text.Encodings.Web, but we don't really want a Newtonsoft.Json dependency at all.

Upgrading to 3.1.25 would fix this. It does contain a breaking change: DependencyContextJsonReader.ReadTargetLibraryDependencies has been removed.

It looks like we don't actually use the Mvc.Core dependency anyway. Dropping that would fix the Newtonsoft.Json issue, and we can update System.Text.Encodings.Web explicitly.