chore(deps): risk-arm dependency bumps (#87)

[windischb]

Low-risk patch/minor dependency bumps, gated locally by a full build + the complete test suite (1395 unit + 516 integration, all green).

No security pressure: dotnet list package --vulnerable reports zero vulnerabilities across the whole graph — the July dependency-report's High (Microsoft.OpenApi 2.0.0) is already resolved by the deliberate 2.7.5 transitive-CVE pin (#113). So this is pure hygiene.

Bumped

• Microsoft.AspNetCore.* 10.0.8 → 10.0.10 (JwtBearer, OpenIdConnect, OpenApi, Mvc.Testing, DI.Abstractions)
• Microsoft.IdentityModel.Tokens 8.19.1 → 8.19.2
• Microsoft.NET.Test.Sdk 18.6.0 → 18.8.1
• Microsoft.SourceLink.GitHub 10.0.300 → 10.0.301
• ITfoxtec.Identity.Saml2 (+ MvcCore) 4.18.0 → 4.20.1
• Quartz.Extensions.Hosting 3.18.1 → 3.18.2
• Testcontainers (+ .PostgreSql) 4.12.0 → 4.13.0
• Postmark 5.3.0 → 5.4.1

Deliberately held (each wants its own careful PR)

• Marten 9.8 → 9.16 / WolverineFx 6.9 → 6.20 — Critter Stack; needs the upgrade-blockers review + its own test pass.
• OpenIddict 7.5 → 7.6 — OAuth core; the DPoP handler ordering/API was just built and verified against 7.5, so a minor bump gets its own pass.
• Microsoft.OpenApi 2.7.5 → 3.x — major, and the 2.7.5 pin is intentional (transitive-CVE guard).
• System.Reactive 6 → 7 — major.
• OpenTelemetry 1.15 → 1.17 — the Prometheus exporter stays beta and lags, so the OTel line should move together, not piecemeal.

🤖 Generated with Claude Code