Update SourceLink to resolve vulnerable Git build dependency

[halter73]

Summary

Update the central Microsoft.SourceLink.GitHub version from 8.0.0 to 10.0.401. This replaces the transitive Microsoft.Build.Tasks.Git 8.0.0 dependency affected by GHSA-23fw-v26w-5fgq / CVE-2026-62900 with 10.0.401, restoring normal builds that previously failed with NU1902.

This is a one-line dependency update based on main. It preserves PrivateAssets="All", existing target frameworks, Dependabot policy, and NuGet auditing without adding warning suppressions or overrides.

Validation

• Reproduced the NU1902 failure before the update; normal full-solution dotnet build then passed with zero warnings and errors.
• dotnet pack --no-build --no-restore --configuration Debug passed. All five product packages retain their target frameworks and exclude SourceLink, Git task, and hashing build dependencies from consumer dependencies.
• Confirmed Microsoft.SourceLink.GitHub, Microsoft.SourceLink.Common, and Microsoft.Build.Tasks.Git resolve to 10.0.401 across all 20 source project/target-framework combinations. All 20 portable PDBs contain the expected SourceLink metadata.
• Core tests passed sequentially on net10.0, net9.0, net8.0, and net472: 9,131 passed, 292 skipped, excluding manual tests and DockerEverythingServerTests.
• Scoped ASP.NET Core tests passed on net10.0, net9.0, and net8.0: 60 passed. Analyzer tests: 57 passed. Test runs used -p:TestTfmsInParallel=false.

Note

This PR description and dependency update were generated with GitHub Copilot.