Lots of CVE as transitive, just update the root cause not the leaf

[tebeco]

Fixes CVE shipped as transitive - Packages are still relying on dotnet and aspnetcore 10.0.0 and 10.0.7 that have CVE

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Summary of the changes (Less than 80 chars)

Description

Fixes CVE as transitive caused but obsolete version of

• Dotnet Runtime
• Aspnetcore Runtime
• Specific Aspnetcore packages

Test: not applicable
Docs: not application (probably, unsure)
Issue: linked

Fixes #3971 (in this specific format)

[Copilot]

Pull request overview

Updates the repository’s net10.0 dependency/version pins to remediate CVEs caused by older transitive runtime/framework package versions, aligning the build with patched .NET/AspNetCore 10.0 servicing releases.

Changes:

• Bump net10.0 runtime and ASP.NET Core runtime version properties to 10.0.10.
• Update the net10.0 Microsoft.AspNetCore.DataProtection pin to 10.0.10 to avoid pulling vulnerable transitive dependencies.

[tebeco]

pinging contributors so that this issue breaking CI/CD in consumer repository could find a solution
@trwalke @bgavrilMS @iarekk @Avery-Dunn @gladjohn

Sorry for pinging everyone but having a base line on x.0.0 and only here and there patching may be X but not why drive all consumer down.

Most of the transitive CVE since 10.0.6 IIRC comes down from direct and transitive of MSFT Identity Web.
We have fully trust in the work being done, but at the same time we expect Security library to build on top of security patches, not manually cherry pick some but not all security patches.