chore(deps): September package and GitHub Actions updates

[ivahno]

Description

September dependency update. Restores were failing NuGet audit (TreatWarningsAsErrors) on two advisories, and the open Dependabot pull requests were either stale or behind the current stable versions.

Vulnerability fixes:

• GHSA-23fw-v26w-5fgq (moderate, NU1902): Microsoft.Build.Tasks.Git 10.0.300, pulled by Microsoft.SourceLink.GitHub 10.0.300. SourceLink is now 10.0.401, which resolves Microsoft.Build.Tasks.Git 10.0.401 (patched line is 10.0.303+).
• GHSA-2m69-gcr7-jv3q / CVE-2025-6965 (high, NU1903): SQLitePCLRaw.lib.e_sqlite3 2.1.11 bundles SQLite 3.49.1. EF Core is now 10.0.12, which resolves SQLitePCLRaw.bundle_e_sqlite3 2.1.12. That package's native library is SQLite 3.53.3 (fixed in 3.50.2).

Direct package bumps:

Package	From	To
Microsoft.CodeAnalysis.CSharp	4.12.0	4.14.0
Microsoft.Extensions.DependencyInjection.Abstractions	10.0.8	10.0.12
Microsoft.Extensions.DependencyInjection	10.0.5	10.0.12
Microsoft.Extensions.Logging.Abstractions	10.0.8	10.0.12
Microsoft.SourceLink.GitHub	10.0.300	10.0.401
xunit.runner.visualstudio	3.1.5	4.0.0
Microsoft.NET.Test.Sdk	18.6.0	18.10.1
FluentAssertions	8.10.0	8.11.0
Microsoft.CodeAnalysis.CSharp.Analyzer.Testing	1.1.2	1.1.4
Microsoft.EntityFrameworkCore (+ Sqlite, InMemory)	10.0.5	10.0.12
AutoMapper	16.1.1	16.2.0
Mapster	10.0.7	10.0.13

The benchmark project no longer overrides Roslyn to 4.14.0; that version is now the central pin.

GitHub Actions: actions/checkout v4 → v7, actions/setup-dotnet v4 → v6. The other actions were already on the majors Dependabot had requested (upload-artifact v7, configure-pages v6, upload-pages-artifact v5, deploy-pages v5, softprops/action-gh-release v3). Checkout v7's breaking change only blocks fork checkout for pull_request_target and workflow_run, which these workflows do not use. setup-dotnet v6 does not change inputs.

Left on the current compatible line on purpose:

• Microsoft.CodeAnalysis.CSharp 4.14.0 and Microsoft.CodeAnalysis.Analyzers 3.11.0. 5.x is what ships with the .NET 10 SDK and makes this generator emit CS9057, so it silently does not run for consumers on the .NET 8/9 SDKs. Dependabot is already configured to ignore those major bumps.
• xunit 2.9.3. That is the latest v2 release. NuGet marks it legacy in favor of xunit.v3, which is a different test framework, not a version bump. xunit.runner.visualstudio 4.0.0 still runs xUnit v2 tests.
• coverlet.collector 10.0.1, Verify.Xunit 31.12.5, Verify.SourceGenerators 2.5.0, BenchmarkDotNet 0.15.8, and Riok.Mapperly 4.3.1 were already current.

This supersedes the open Dependabot pull requests: #12, #15, #16, #20, #21, #33, #42, #48, #49, #50, #51.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)

Checklist

• My code follows the project's coding standards
• I have added tests that prove my fix is effective or my feature works
• All new and existing unit tests pass
• I have verified AOT compatibility (no trim warnings)
• I have updated documentation as needed
• Any breaking changes are documented below

Breaking Changes

None.

Generated Code Impact

None. Generator snapshot tests passed unchanged on Roslyn 4.14.0.

Verification

• dotnet list package --vulnerable --include-transitive: no vulnerable packages.
• dotnet test -c Release: 566 passed (Abstractions 74, Core 63, Integration 51, Projection 10, Generator 368).
• dotnet build -c Release: 0 warnings, 0 errors, including samples and benchmarks.
• eng/package-smoke-test.sh: packaged generator runs for direct mapping and DI.
• dotnet publish samples/OpenAutoMapper.Samples.Aot -c Release -r osx-arm64: native publish succeeded.
• dotnet format --verify-no-changes --severity warn: clean.