Align Microsoft NuGet packages and harden Dependabot config

[pejmantheory]

Summary

• Bump Microsoft/System packages to 9.0.16 in HelloblueGK.csproj, WebAPI/HelloblueGK.WebAPI.csproj, and Tests/HelloblueGK.Tests.csproj (fixes NU1605 failures from Dependabot PR Bump the microsoft group with 13 updates #61 updating only the root project)
• Add Docker major-version ignores for dotnet/sdk and dotnet/aspnet so .NET 10 image PRs do not reopen
• Group GitHub Actions Dependabot updates (actions/*, docker/*) into weekly batches
• Harden CI Docker build: load: true and provenance: false for build-push-action@v7 test builds

Context

• Dependabot PRs chore(deps): bump actions/setup-python from 4 to 6 #54–chore(deps): bump actions/upload-artifact from 4 to 7 #58 (GitHub Actions) and chore(deps): bump docker/build-push-action from 5 to 7 #57/chore(deps): bump actions/upload-artifact from 4 to 7 #58 are already merged on main
• Dependabot PRs chore(deps): bump dotnet/sdk from 9.0 to 10.0 #59, chore(deps): bump dotnet/aspnet from 9.0 to 10.0 #60 (Docker .NET 10), and Bump the microsoft group with 13 updates #61 (partial Microsoft group) were closed

Test plan

• CI passes (Build and Test, Integration Tests, Docker Build Test)
• dotnet restore Tests/HelloblueGK.Tests.csproj succeeds without NU1605 errors

Made with Cursor

---

Note

Low Risk
Patch-level dependency alignment and CI/Dependabot config only; no application logic changes, though EF and auth packages are among those bumped.

Overview
Aligns Microsoft and System NuGet references to 9.0.16 across the root, WebAPI, and Tests projects so restore no longer hits NU1605 from mismatched versions (e.g. partial Dependabot bumps on only one .csproj).

Dependabot now ignores major Docker updates for dotnet/sdk and dotnet/aspnet to stay on .NET 9 images, and batches weekly GitHub Actions updates for actions/* and docker/*.

CI’s Docker Build Test job sets load: true and provenance: false on docker/build-push-action@v7 for local-load test builds without provenance metadata.

^{Reviewed by Cursor Bugbot for commit 121aa36. Bugbot is set up for automated code reviews on this repo. Configure here.}