Bump Microsoft.OpenApi to patched 2.7.5

Author: marianards

api/api.csproj

@@ -48,6 +48,12 @@
     <PackageReference Include="MQTTnet" Version="4.3.7.1207" />
     <PackageReference Include="MQTTnet.Extensions.ManagedClient" Version="4.3.7.1207" />
     <PackageReference Include="Swashbuckle.AspNetCore" Version="10.2.3" />
+    <!--
+      Pin Microsoft.OpenApi to the patched 2.x version (2.7.5) instead of the
+      vulnerable 2.4.1 pulled in transitively by Swashbuckle.AspNetCore
+      (CVE-2026-49451 / GHSA-v5pm-xwqc-g5wc).
+    -->
+    <PackageReference Include="Microsoft.OpenApi" Version="2.7.5" />
     <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.7" />
     <!-- Pin Kiota.Abstractions to the patched version until Graph updates transitively. -->
     <!--