Keep Dependabot NuGet updates behind the HL7 pin and the internal mirror

[Mikael Weaver (mikaelweave)]

Two Dependabot NuGet fixes: stop Anonymizer from dragging the Hl7.Fhir pin forward, and give package mirrors time to catch up before proposing new versions.

AB#207007

1. Block Anonymizer ≥ 4.3

#5869 bumped Hl7FhirVersion 5.11.4 → 5.12.0 despite the Hl7.Fhir.* ignore rule from #5863. ignore stops Dependabot proposing an update, but it still bumps an ignored package when another update requires it. #5869 moved Microsoft.Health.Fhir.Anonymizer.* 4.1.1.3 → 4.3.3.5, which requires Firely ≥ 5.12.0:

Anonymizer	requires Hl7.Fhir.Base
4.1.1.3 (current)	≥ 5.11.3
4.2.2.5	≥ 5.11.3
4.3.3.5	≥ 5.12.0

Ignoring >= 4.3 still lets Anonymizer move to 4.2.2.5. Lift it together with the Hl7.Fhir.* rule.

Known gap: Ignixa.Extensions.FirelySdk5 also depends on Hl7.Fhir.Base. It's left updating by choice; close any Ignixa PR that drags HL7 forward. The props comment says so.

2. NuGet cooldown: 8 days, 14 for majors

Some consumers of this repository restore through package mirrors that hold back newly published NuGet versions for about a week. Dependabot's built-in cooldown is only 3 days, so it could bump a package to a version those mirrors can't serve yet.

8 days sits a little past a week so the two clocks can't race.

⚠️ Security updates skip cooldown by design, so a security bump can still reference a version a mirror hasn't released yet.

Verification

• Anonymizer nuspecs read from the Microsoft Health OSS feed. Scanned every catalog package in the local NuGet cache: only Anonymizer and Ignixa.Extensions.FirelySdk5 depend on Hl7.Fhir.*.
• >= 4.3 checked with Gem::Requirement (what Dependabot's NuGet parser uses): 4.2.2.5 allowed, 4.3.3.5 / 4.4 / 5.0 blocked. Rule matches exactly the 2 Anonymizer packages.
• NuGet supports both default-days and semver-major-days (options reference). Other ecosystems unchanged.
• YAML and XML parse, ValidateDependabotCoverage passes.

After merge

Close #5869. It regenerates without the Anonymizer and HL7 bumps.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.99%. Comparing base (275828c) to head (7badf65).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5870      +/-   ##
==========================================
+ Coverage   78.67%   78.99%   +0.32%     
==========================================
  Files        1020     1020              
  Lines       37371    37375       +4     
  Branches     5716     5718       +2     
==========================================
+ Hits        29401    29524     +123     
+ Misses       6540     6447      -93     
+ Partials     1430     1404      -26     

see 18 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.