chore(deps): bump Microsoft package pins to 10.0.11

[rlorenzo]

What

Bumps pinned Microsoft.* / System.* packages in web/Viper.csproj and test/Viper.test.csproj from 10.0.10 to 10.0.11 (August 2026 servicing release). No code changes. global.json needs no edit: rollForward: latestFeature picks up SDK 10.0.400 on its own.

CVEs

Of the 10 in this release, 2 reach our runtime and neither is exploitable through our code:

• CVE-2026-62898 (7.5, QUIC use-after-free): HTTP/3 is opt-in, we sit behind IIS/HTTP.sys and never set HttpVersion.Version30.
• CVE-2026-62900 (5.9, Microsoft.Build.Tasks.Git): build-time leak of credentials embedded in the git remote URL, ours is a plain HTTPS GitHub URL. Fixed by SDK 10.0.303+.

The rest do not apply: 62901 needs WebSockets (we have none), five are WPF-only, two are Linux/macOS-only.

Updating .NET

Elevated PowerShell:

winget install --id Microsoft.DotNet.SDK.10-e --accept-package-agreements --accept-source-agreements

Gives SDK 10.0.400 plus the 10.0.11 runtimes. Servers take Microsoft.DotNet.HostingBundle.10 instead, which restarts IIS.

Testing

npm run verify:build passes, npm run test:backend 2708/2708.

[codecov-commenter]

Bundle Report

Bundle size has no change ✅

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.74%. Comparing base (21551ff) to head (e2e7e44).

Additional details and impacted files

@@ Coverage Diff @@## main #313 +/- ##
=======================================
Coverage 41.74% 41.74% =======================================
Files 992 992 Lines 49697 49697 Branches 5854 5854 =======================================
Hits 20748 20748 Misses 28038 28038 Partials 911 911 

Flag	Coverage Δ
backend	39.80% <ø> (ø)
frontend	58.15% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.