fix(deps): bump Microsoft.SourceLink.GitHub to 10.0.401 to clear GHSA-23fw-v26w-5fgq

[maxiar]

The solution does not build right now. Microsoft.SourceLink.GitHub 8.0.0 pulls
Microsoft.Build.Tasks.Git 8.0.0, which has since picked up a moderate-severity advisory
(GHSA-23fw-v26w-5fgq). With NuGet audit plus
TreatWarningsAsErrors that surfaces as NU1902 and fails the whole solution, not just the
projects that pack:

error NU1902: Warning As Error: Package 'Microsoft.Build.Tasks.Git' 8.0.0 has a known
moderate severity vulnerability [src/FSH.Starter.slnx]

10.0.401 is the current stable line and clears it. This is the only change — no source edits were
needed.

Verification

dotnet build src/FSH.Starter.slnx                                  -> 0 errors
dotnet list src/FSH.Starter.slnx package --vulnerable --include-transitive
                                                                   -> no vulnerable packages
dotnet test src/Tests/Architecture.Tests                           -> 55/55 pass

Nothing else moves: SourceLink is referenced only by projects with IsPackable=true, so the blast
radius is the CLI package.

🤖 Generated with Claude Code

[marcelo-maciel]

Backend CI here is red for one reason that is not this PR's doing: restore trips over the SSH.NET advisory (GHSA-q939-rpr3-3284) that comes in through Testcontainers 4.11.0 on main. #1369 clears it and is green.

Order is therefore #1369, then this one. Worth knowing: GitHub does not re-run a PR's checks when the base branch moves, so after #1369 lands this PR needs gh pr update-branch 1375 (or any push) before it turns green, even though nothing here will have changed.

Full merge order for the batch, with the pairwise conflicts measured rather than guessed: #1369 comment.

[marcelo-maciel]

Reviewed. The change is a one-line version bump and it does what it says; Microsoft.SourceLink.GitHub 10.0.401 restores cleanly on .NET 10 and clears the advisory that blocks restore under TreatWarningsAsErrors. Several PRs in the current batch already carry this exact bump to get their own CI past restore, and it is green on all of them.

The only thing standing between this PR and a green Backend CI is unrelated to it: restore also trips over the SSH.NET advisory that arrives through Testcontainers 4.11.0, which #1369 fixes. Merge order and the re-run caveat are in the batch comment.