deps(deps): bump actions/setup-dotnet from 5 to 6 - #130

Rolls the six open Dependabot bumps (#124, #125, #126, #128, #129, #130)
into one change and closes the version gaps those PRs left open.

The nuget open-pull-requests-limit of five was fully consumed by
single-package bumps, so several packages on the same release train had
no PR open: EntityFrameworkCore.SqlServer, Mvc.Testing, EFCore.InMemory
and EFCore.Sqlite were all still on 10.0.9 with 10.0.10 available.
Merging #128 on its own would have left Design/Tools on 10.0.10 against
SqlServer 10.0.9.

Web.Tests was also on Test SDK 18.6.0 while E2ETests was on 18.7.0. #123
would have closed that gap but was resolved as superseded by #129, which
only touches E2ETests.

dotnet-ef in the tool manifest moves to 10.0.10 to match. Dependabot has
been able to read dotnet-tools.json since 2024, but the nuget
configuration only scans /src/** and /tests/**, and the manifest sits at
the repository root, so nothing was watching it. Widening the scan is
handled separately.

Verified locally: build with no warnings, 240 unit tests, 8 Playwright
E2E tests, and dotnet format --verify-no-changes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Three changes to the nuget ecosystem, plus a correction to an earlier
claim of mine.

Scan directories gain "/". Both the CPM manifest added in the previous
commit and the existing dotnet-tools.json live at the repository root,
which /src/** and /tests/** do not cover. This, not a gap in Dependabot,
is why dotnet-ef sat on 10.0.9 while EF Core moved: Dependabot has
discovered and analyzed dotnet-tools.json since 2024
(dependabot-core#8889 and #10269). An earlier commit message in this
branch stated the opposite and was wrong.

Grouping ASP.NET Core, EF Core and dotnet-ef together is the substantive
fix. They ship as one train, and splitting them into separate PRs is what
let Design/Tools drift ahead of SqlServer. Major bumps stay ungrouped so
something like ImageSharp 3.x to 4.0 still lands on its own.

The limit goes from five to ten. At the limit Dependabot defers opening
the remaining PRs to a later run rather than dropping them, but nothing
reports the deferral, so four packages sat on 10.0.9 with no PR and no
signal.

github-actions is deliberately left ungrouped. Dependabot already emits
one PR per action across every workflow that uses it, which is what #130
did for setup-dotnet across five files, so a group adds nothing there
while making unrelated major bumps share a PR and a CI failure.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Three changes to the nuget ecosystem, plus a correction to an earlier
claim of mine.

Scan directories gain "/". Both the CPM manifest added in the previous
commit and the existing dotnet-tools.json live at the repository root,
which /src/** and /tests/** do not cover. This, not a gap in Dependabot,
is why dotnet-ef sat on 10.0.9 while EF Core moved: Dependabot has
discovered and analyzed dotnet-tools.json since 2024
(dependabot-core#8889 and #10269). An earlier commit message in this
branch stated the opposite and was wrong.

Grouping ASP.NET Core, EF Core and dotnet-ef together is the substantive
fix. They ship as one train, and splitting them into separate PRs is what
let Design/Tools drift ahead of SqlServer. Major bumps stay ungrouped so
something like ImageSharp 3.x to 4.0 still lands on its own.

The limit goes from five to ten. At the limit Dependabot defers opening
the remaining PRs to a later run rather than dropping them, but nothing
reports the deferral, so four packages sat on 10.0.9 with no PR and no
signal.

github-actions is deliberately left ungrouped. Dependabot already emits
one PR per action across every workflow that uses it, which is what #130
did for setup-dotnet across five files, so a group adds nothing there
while making unrelated major bumps share a PR and a CI failure.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>