build: Modernize .NET and NuGet Trusted Publishing

[erenken]

Summary

• Target .NET 8/10 throughout the library, sample and tests; update dependencies and modernize MSTest assertions.
• Centralize warning-as-error settings and portable PDBs; pin a stable SDK and validation tool versions.
• Validate GitVersion 6 patch/minor/major increments, tags, reruns, branch previews and merge-message increments.
• Stamp all package/assembly/file/informational versions and exact repository commit consistently.
• Share full restore/build/test/coverage/pack/audit validation between CI and releases; use current stable actions.
• Inspect packaged .snupkg PDBs for both frameworks and download/checksum exact-commit Source Link sources before publishing.
• Publish stable main-only packages/symbols using NuGet/login OIDC, then create the matching stable GitHub release and immutable tag; handle duplicate pushes and reruns.
• Document installation, local builds, versioning, Source Link debugging and temporary-file cleanup; add Dependabot.

Validation completed locally

• Restore/build/pack: 0 warnings, 0 errors.
• Tests: 9 passed on net8.0 + 9 passed on net10.0, with TRX and Cobertura coverage.
• Packaged Source Link: both portable PDBs point to the exact commit; source downloads/checksums pass.
• GitVersion isolated-repository scenarios: stable release tags, patch increments, tagged reruns, explicit minor/major, branch previews and merge increments all pass.
• actionlint 1.7.12 and git diff --check pass.
• NuGet vulnerability scan (including transitive dependencies): none found.
• Outdated scan: direct .NET 10/test dependencies current; .NET 8 EF/Extensions remain on their supported 8.x lines intentionally. Some test-tool transitive dependencies remain pinned by their upstream packages.

Repository/account configuration completed

• NUGET_USER secret set to the NuGet account username.
• nuget GitHub environment created and restricted to the main branch.
• Default workflow token permissions changed to read-only.
• NuGet policy queryPattern-release created and verified active: erenken/queryPattern, release.yml, environment nuget, exact package myNOC.EntityFramework.Query, push new versions only.

After merge

• First production OIDC publish/release can only be exercised on main; this PR does not merge or publish previews.
• Remove the legacy NUGET_PUBLISH GitHub secret and revoke the old NuGet API key once the new main release is confirmed. It is retained until then to avoid breaking the existing main workflow.
• Production OIDC publishing remains deliberately unexercised until this PR is merged into main.

Final validation (commit 72a088c)

• PR CI run, including successful rerun attempt 2: success.
• Branch preview CI run: success.
• CodeQL analysis: success; no open CodeQL alerts for this branch.
• Linux CI and local Windows: 0 build warnings/errors; 9/9 tests passed per framework; packages and coverage artifacts uploaded.
• Packaged Source Link downloads/checksums, exact-commit metadata, stamped versions and DLL/PDB identities pass for net8.0 and net10.0 at commit 72a088c.
• CI computed the PR preview as 0.1.5-pr7.2; local work-branch preview is 0.1.5-alpha.modernize-pipeline.2.
• Stable-only guard rejects prereleases, build metadata, four-part/leading-zero versions and non-main branches; synthetic PR preview scenarios pass.
• NuGet duplicate-provenance validation tested against published 0.1.4: matching commit accepted, wrong commit rejected, missing version handled without suppressing other HTTP errors.
• Release/Debug local builds are warning/error-free; actionlint (including Linux shellcheck), whitespace and dependency vulnerability scans pass.
• Main branch protection now requires up-to-date successful build-test/workflow-lint checks and resolved conversations; force-push/deletion prohibited, merged topic branches automatically deleted.
• Working tree clean; branch pushed and synchronized. Generated validation tools/reports/packages remain ignored.