[EFCore.Tests] Drop reference to SQLite

[Kielek]

Mitigate GHSA-2m69-gcr7-jv3q

Changes

[EFCore.Tests] Drop reference to SQLite
Can be reverted when dotnet/efcore#38463 is fixed

Merge requirement checklist

• CONTRIBUTING guidelines followed (license requirements, nullable enabled, static analysis, etc.)
• Unit tests added/updated
• [ ] Appropriate CHANGELOG.md files updated for non-trivial changes
• [ ] Changes in public API reviewed (if applicable)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.83%. Comparing base (8c223ac) to head (5c495a0).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4543      +/-   ##
==========================================
- Coverage   76.05%   75.83%   -0.23%     
==========================================
  Files         439      439              
  Lines       18115    18115              
==========================================
- Hits        13777    13737      -40     
- Misses       4338     4378      +40     

Flag	Coverage Δ
unittests-Contrib.Shared.Tests	87.91% <ø> (ø)
unittests-Exporter.Geneva	55.12% <ø> (-0.57%)	⬇️
unittests-Exporter.InfluxDB	95.75% <ø> (ø)
unittests-Exporter.OneCollector	94.67% <ø> (ø)
unittests-Extensions	90.61% <ø> (ø)
unittests-Extensions.Enrichment	100.00% <ø> (ø)
unittests-Extensions.Enrichment.AspNetCore	86.27% <ø> (ø)
unittests-Extensions.Enrichment.Http	94.33% <ø> (ø)
unittests-Instrumentation.AWS	85.21% <ø> (ø)
unittests-Instrumentation.AspNet	77.50% <ø> (ø)
unittests-Instrumentation.AspNetCore	88.15% <ø> (ø)
unittests-Instrumentation.Cassandra	92.68% <ø> (ø)
unittests-Instrumentation.ConfluentKafka	82.04% <ø> (ø)
unittests-Instrumentation.ElasticsearchClient	80.36% <ø> (ø)
unittests-Instrumentation.EntityFrameworkCore	80.63% <ø> (-0.40%)	⬇️
unittests-Instrumentation.EventCounters	77.47% <ø> (ø)
unittests-Instrumentation.GrpcCore	91.18% <ø> (ø)
unittests-Instrumentation.GrpcNetClient	78.50% <ø> (ø)
unittests-Instrumentation.Hangfire	88.83% <ø> (ø)
unittests-Instrumentation.Http	74.81% <ø> (ø)
unittests-Instrumentation.Owin	88.88% <ø> (ø)
unittests-Instrumentation.Process	100.00% <ø> (ø)
unittests-Instrumentation.Quartz	78.37% <ø> (ø)
unittests-Instrumentation.Remoting	65.59% <ø> (ø)
unittests-Instrumentation.Runtime	100.00% <ø> (ø)
unittests-Instrumentation.ServiceFabricRemoting	39.91% <ø> (ø)
unittests-Instrumentation.SqlClient	82.36% <ø> (ø)
unittests-Instrumentation.StackExchangeRedis	94.18% <ø> (ø)
unittests-Instrumentation.Wcf	82.09% <ø> (-0.14%)	⬇️
unittests-OpAmp.Client	86.16% <ø> (-0.30%)	⬇️
unittests-PersistentStorage	67.74% <ø> (-1.47%)	⬇️
unittests-Resources.AWS	73.61% <ø> (ø)
unittests-Resources.Azure	87.67% <ø> (ø)
unittests-Resources.Container	67.34% <ø> (ø)
unittests-Resources.Gcp	71.42% <ø> (ø)
unittests-Resources.Host	72.26% <ø> (ø)
unittests-Resources.OperatingSystem	76.98% <ø> (ø)
unittests-Resources.Process	90.47% <ø> (ø)
unittests-Resources.ProcessRuntime	79.59% <ø> (ø)
unittests-Sampler.AWS	95.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 8 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[martincostello]

Can we just comment it out rather than delete it?

Personally I think we can just suppress the NuGet audit warnings until the fix is available, especially as this is only test code (that's what I'm going to do in my own projects).

[Kielek]

I was considering this, but I think the revert can be done as easy as uncommenting code.
Suppression - with the current experience, and security reports I am keen to fully remove problematic packages instead of handling later some very important security findings, but I will not block such solution.

[martincostello]

This is what I did in one of my own projects: martincostello/openapi-extensions@7465d7b

I think it's better to suppress it as:

1. We keep the test coverage we get from using SQLite for integration tests
2. It's only test code not anything we ship (and if we did, we'd only be able to wait anyway)
3. From looking at the GHSA, I don't think it's actually a problem for us as we control the queries and aren't doing anything that will hit the memory corruption
4. It's a smaller "fix" that uses a well-known mechanism for false positives

[Kielek]

Replaced by #4544