CONFIG: Update NuGet dependencies to latest stable (Component Versions dashboard green)

[perirrs]

Summary

Clears all 15 "behind" references on the Component Versions dashboard for ISL.ReIdentification. Branched on top of #561. Supersedes dependabot #559/#560 (both fail Build by design - see below; they auto-close/should be closed on merge) and #558 stays closed per the FluentAssertions policy.

closes AB#29743
(Follow-up under the same repo task; AZDO closure is handled manually.)

Changes (one per commit, each build-gated)

1. SpaProxy x2: normalised child-element form to attribute form - version unchanged (10.0.10); the dashboard parser only reads the Version attribute, so these two rows were false positives
2. Microsoft.OpenApi x2 -> [2.11.0] bracket pin: 3.x is incompatible with the .NET 10 AspNetCore.OpenApi source generator (CS0200 - proven by dependabot CONFIG: Bump Microsoft.OpenApi from 2.11.0 to 3.9.0 #560); the direct ref must STAY because it holds out the NU1903-vulnerable transitive 2.4.1. Bracketed so the dashboard counts it Pinned; dependabot now ignores 3.x
3. ISL.Providers.Notifications.GovukNotify 0.0.0.3 -> 2.0.0.1 + adaptation: new SendSmsAsync(mobileNumber)/SendLetterAsync(recipient + address lines) signatures in NotificationBroker, and the GovUkNotifyProvider rename in the three Program.cs DI registrations (bump alone fails CS7036/CS0246 - dependabot CONFIG: Bump ISL.Providers.Notifications.GovukNotify from 0.0.0.3 to 2.0.0.1 #559)
4. NHSISL.CsvHelperClient 1.1.0 -> 3.1.0 (x10 projects) + CsvHelperBroker adapted INTERNALLY to the 3.x Stream/IAsyncEnumerable API. The broker interface is unchanged, so IdentificationCoordinationService (including the new hex path from CODE RUB: Fix Tests and add Hex ability #561) and all tests are untouched - this is the containment fix whose absence forced the earlier revert on ISL.Providers.ReIdentification

Validation (local)

• Build Release: 0 errors
• ISL.ReIdentification.Core.Tests.Unit: 964/964 passed (includes CODE RUB: Fix Tests and add Hex ability #561's hex tests as a regression net over the CSV path)
• dotnet list package --outdated: nothing unpinned remains
• dotnet list package --vulnerable --include-transitive: none
• FluentAssertions remains locked [7.2.2]

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[perirrs]

Status: all checks green EXCEPT Build - acceptance suites only, needs a pair of eyes

What passes: full solution build, ISL.ReIdentification.Core.Tests.Unit 964/964 (including the #561 hex tests over the CSV path), CodeQL/Sonar/Linting/prLinter.

What fails (reproduced on a rerun, so not flake): Configurations AuditsApiTests x5 + Portals ReIdentificationApiTests x9. Symptom is identical everywhere: the API returns audits stamped with the authenticated test user (65b5ccfb-...) and server-side timestamps, while the tests expect their seeded CreatedBy/UpdatedBy/dates (e.g. 2c00cf04-...). main is green at the same base commit (#561 merge).

Why this is odd: none of the four commits here touches audits, auth, or the coordination service - the unit suite is untouched and green. Chief suspect is a transitive shift: ISL.Providers.Notifications.GovukNotify 2.0.0.1 pulls newer GovukNotify/Microsoft.IdentityModel dependencies than 0.0.0.3, which can change claims/user-resolution behaviour in the test hosts. The CsvHelperClient 3.1.0 broker adaptation is interface-preserving and covered green by the unit + hex tests.

Suggested next step: run the Configurations acceptance suite locally against this branch with a breakpoint on SecurityBroker.GetCurrentUserAsync / ApplyAddAuditAsync to see which claim the EntraUserId resolves from, and compare resolved Microsoft.IdentityModel.* versions vs main (dotnet list package --include-transitive diff). Happy to split the GovukNotify commit out to its own PR if that isolates it.