Security: pin vulnerable transitives (CVE-2026-33116, Scriban) — mirrors upstream #1592

@artnim

Mirror of upstream PR nuke-build/nuke#1592 by @artnim, which fixes upstream issue nuke-build/nuke#1591.

What it fixes

System.Security.Cryptography.Xml (transitive)
- CVE-2026-33116 — GHSA-37gx-xxp4-5rgx — infinite-loop DoS in EncryptedXml
- CVE-2026-26171 — GHSA-w3x6-4m5h-cxqf
- Pinned per-TFM: 10.0.6 / 9.0.15 / 8.0.3
Scriban 6.2.1 → 7.1.0 (direct dep in Nuke.SourceGenerators) — clears 1 critical + 5 high + 3 moderate advisories (critical = GHSA-5wr9-m6jw-xx44)
Incidental NuGet.Packaging 6.12.1 → 6.14.3

Enables CentralPackageTransitivePinningEnabled in Directory.Packages.props
TFM-conditional PackageVersion Update entries (same pattern already used for Microsoft.Build.*)
Direct PackageReference in build/_build.csproj since it opts out of CPM

Branch pr/1592-vulnerable-transitives — cherry-picked PR head onto our develop (clean, no rebase needed):

Stage	Result
`dotnet restore nuke-common.slnx`	✅ 26/26 projects
`dotnet build nuke-common.slnx`	✅ 0 errors, 10 pre-existing warnings
Full `dotnet test nuke-common.slnx`	✅ 391 passed, 0 failed, 7 skipped (CI-only)
`Nuke.SourceGenerators.Tests` (Scriban 6→7 risk surface)	✅ 3/3, no Verify snapshot drift

Credit: @artnim. Targeting 10.2.0 as our first own release line.

docs(agents): default to backwards compatibility — add principle to A…

Rename MSBuildSettings to MsBuildSettings for casing consistency

Make release.yml the label source of truth and require PR labelling a…

Align docs on evergreen target/vCurrent + target/vNext labels

Document fork/upstream branching workflow and reinforce draft-PR default