Upgrade NuGet packages to clear all Snyk high-severity findings

[devin-ai-integration]

Summary

Patch-level dependency upgrades that clear all 5 HIGH Snyk findings without leaving .NET 7 and without touching application code. Four of the five vulnerable packages are transitive, so they are fixed by bumping the direct parents (EF Core 7.0.10 -> 7.0.20 pulls Microsoft.Data.SqlClient 5.0.2 -> 5.1.5, which drops the vulnerable System.Drawing.Common 5.0.0). Two packages are pinned explicitly because the version the graph resolves to is itself vulnerable and its 7.0.x parent line was never patched:

• System.Text.Json 8.0.6 — transitive 7.0.0 came via Microsoft.Extensions.DependencyModel 7.0.0; the package supports net7.0, so no TFM change.
• Azure.Identity 1.13.2 — Microsoft.Data.SqlClient 5.1.5 pulls 1.10.3, which fixes the high RCE but introduces two new mediums (SNYK-DOTNET-AZUREIDENTITY-6597976, -7246762) and drags in a vulnerable Microsoft.Identity.Client 4.56.0. Pinning 1.13.2 means this PR introduces zero new findings at any severity.

Version changes:

• Microsoft.EntityFrameworkCore, .Design, .SqlServer, .Tools: 7.0.10 -> 7.0.20
• Npgsql: 7.0.4 -> 7.0.10 (fix line is 7.0.7+)
• Npgsql.EntityFrameworkCore.PostgreSQL + .NodaTime: 7.0.4 -> 7.0.18 (kept in step with Npgsql)
• Microsoft.AspNetCore.OpenApi: 7.0.9 -> 7.0.20
• new explicit pins: System.Text.Json 8.0.6, Azure.Identity 1.13.2
• CI (.github/workflows/dotnet.yml): dotnet-version 6.0.x -> 7.0.x. The workflow installed the 6.0 SDK while the projects target net7.0, so dotnet test aborted on the runner with "You must install or update .NET to run this application" — that failure predates this PR and blocked any green build.

All package upgrades stay within their existing major version. dotnet build is clean (same 3 pre-existing nullable warnings) and all 20 tests pass.

Snyk findings fixed

Snyk ID	Package	Severity
SNYK-DOTNET-AZUREIDENTITY-6009155	Azure.Identity 1.6.0 (RCE)	high
SNYK-DOTNET-MICROSOFTDATASQLCLIENT-6149434	Microsoft.Data.SqlClient 5.0.2 (unprotected credential storage)	high
SNYK-DOTNET-NPGSQL-6825563	Npgsql 7.0.4 (SQL injection)	high
SNYK-DOTNET-SYSTEMDRAWINGCOMMON-3063427	System.Drawing.Common 5.0.0 (RCE)	high
SNYK-DOTNET-SYSTEMTEXTJSON-7433719	System.Text.Json 7.0.0 (DoS)	high

Before / after (snyk test --all-projects --detection-depth=4, Snyk CLI 1.1306.4):

Project	Before	After
src/Infrastructure	10 high, 9 medium	0
src/WebApi	11 high, 9 medium	0
tests/WebApi.Tests	7 high, 17 medium	1 medium
others	0	0

0 critical before and after; high 28 (with cross-project duplicates) -> 0. The one remaining medium is a test-only transitive in Microsoft.NET.Test.Sdk.

Intentionally not fixed here

• Medium/low findings are out of scope per the task; the surviving one is test-only.
• Base image: the Dockerfile still targets mcr.microsoft.com/dotnet/aspnet:7.0, out of support and heavily vulnerable per Snyk (184 vulns / 6 critical). That needs a framework bump, done separately in Upgrade to .NET 8 LTS (out-of-support runtime and base image) #69 (net8.0 + aspnet:8.0). Upgrade to .NET 8 LTS (out-of-support runtime and base image) #69 supersedes this PR; this one exists as the low-risk option if you would rather not move framework versions yet.
• Microsoft.EntityFrameworkCore.SqlServer is referenced but unused (no UseSqlServer/SqlClient anywhere in .cs). Removing it would delete the whole SqlClient/Azure.Identity/Drawing chain, but that is a dependency-surface change, so it was upgraded rather than dropped.

Link to Devin session: https://app.devin.ai/sessions/515d976343dd48cd8c94e0ffe96bc259
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring