fix: bump ASP.NET Core/EF Core to 10.0.13 and pin vulnerable transitive packages

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Directory.Packages.props

@@ -1,13 +1,19 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
     <AspireVersion>13.6.1</AspireVersion>
-    <AspNetCoreVersion>10.0.12</AspNetCoreVersion>
+    <AspNetCoreVersion>10.0.13</AspNetCoreVersion>
-    <EfCoreVersion>10.0.12</EfCoreVersion>
+    <EfCoreVersion>10.0.13</EfCoreVersion>
     <OpenTelemetryVersion>1.19.1</OpenTelemetryVersion>
   </PropertyGroup>
 
+  <ItemGroup Label="Transitive security pins">
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="$(AspNetCoreVersion)" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="$(AspNetCoreVersion)" />
+    <PackageVersion Include="MessagePack" Version="2.5.307" />
+  </ItemGroup>
+
   <ItemGroup Label="Aspire">
     <PackageVersion Include="Aspire.Hosting.SqlServer" Version="$(AspireVersion)" />
     <PackageVersion Include="Aspire.Hosting.Docker" Version="$(AspireVersion)" />