Configure ServiceBusProcessorOptions for Azure Service Bus listeners (supersedes #3286)

[jeremydmiller]

Supersedes #3286 (by @jorik). The original commit is preserved verbatim (same authorship); this PR adds only the dependency fix needed to get CI green on current main.

Feature (from #3286, @jorik)

Adds a ConfigureProcessor(Action<ServiceBusProcessorOptions>) fluent method on both AzureServiceBusQueueListenerConfiguration and AzureServiceBusSubscriptionListenerConfiguration, so long-running inline handlers can raise MaxAutoLockRenewalDuration (and set any other ServiceBusProcessorOptions) instead of being stuck at the Azure SDK's 5-minute default. ReceiveMode is re-asserted to PeekLock since the inline listener acks/defers/dead-letters against the lock. Scoped to the non-session inline processor paths. See #3286 for the full write-up.

Why a superseding PR

#3286's branch was behind main and its core CI jobs (build, test, CIKafka, CIPersistence, describe-handlers-smoke) went red — not because of the ASB change, but because a newly-published advisory tripped restore repo-wide.

Dependency fix

Microsoft.AspNetCore.OpenApi 10.0.0 transitively pulls Microsoft.OpenApi 2.0.0, which now carries a high-severity advisory (GHSA-v5pm-xwqc-g5wc — uncontrolled recursion / stack overflow parsing circular schema refs; patched in 2.7.5). With TreatWarningsAsErrors=true, the NU1903 restore audit becomes a hard build break.

Fix:

• Add a centrally-versioned Microsoft.OpenApi 2.7.5 in Directory.Packages.props.
• Add a scoped direct reference in a new Directory.Build.targets, applied only when a project targets net10.0 and references Microsoft.AspNetCore.OpenApi, so the patched 2.7.5 (same 2.x major) wins over the transitive 2.0.0.

Deliberately narrow — verified against the actual resolved graphs:

• net9.0 resolves Microsoft.OpenApi 1.6.x (not in the affected range) → left untouched.
• Swashbuckle-only web apps resolve Microsoft.OpenApi 1.2.x → forcing 2.x would break Swashbuckle 6.5.0, and they aren't vulnerable → left untouched.
• Non-web test projects (e.g. Wolverine.Kafka.Tests) inherit the pin transitively via their project references to the web apps.

Verification (local)

• dotnet restore wolverine.slnx → exit 0, 0 × NU1903, no new errors.
• Resolved versions confirmed per TFM: InMemoryMediator net10 → 2.7.5, net9 → 1.6.17; Swashbuckle-only app → 1.2.3 both TFMs; Wolverine.Kafka.Tests net10 → 2.7.5 (inherited).
• CoreTests (net9.0): 1834 passed, 0 failed, 2 skipped.
• Wolverine.AzureServiceBus / .Tests build clean.

Closing #3286 in favor of this. Full credit to @jorik for the feature.

🤖 Generated with Claude Code