Update NuGet dependencies to latest and switch to trusted publishing

[StuartMeeks]

Summary

Two maintenance changes requested together:

1. Bump NuGet dependencies to latest stable

All package references updated to their latest non-prerelease versions. The intentionally capped NextIteration.SpectreConsole.Auth range ([0.6.1,1.0.0)) is left untouched.

Package	Before	After
Microsoft.Extensions.DependencyInjection.Abstractions	10.0.5	10.0.9
Microsoft.Extensions.Http	10.0.5	10.0.9
Spectre.Console	0.55.2	0.56.0
Microsoft.SourceLink.GitHub	8.0.0	10.0.300
Microsoft.Extensions.DependencyInjection	10.0.5	10.0.9
Microsoft.NET.Test.Sdk	17.11.1	18.6.0
xunit	2.9.2	2.9.3
xunit.runner.visualstudio	2.8.2	3.1.5
coverlet.collector	6.0.2	10.0.1

Build is clean (0 warnings, with TreatWarningsAsErrors) and all 59 tests pass. dotnet pack still produces both .nupkg and .snupkg.

2. Switch publishing to NuGet trusted publishing (OIDC)

The publish job no longer relies on a long-lived NUGET_API_KEY secret. Instead it:

• grants the job id-token: write (plus contents: read),
• uses NuGet/login@v1 immediately before push to exchange the GitHub OIDC token for a short-lived (1-hour) nuget.org API key,
• passes that temporary key to dotnet nuget push.

RELEASING.md prerequisites are updated to match.

⚠️ Manual setup required before the next release

This won't publish until the nuget.org side is configured:

1. Create a trusted publishing policy on nuget.org (username → Trusted Publishing): Repository Owner StuartMeeks, Repository NextIteration.SpectreConsole.Auth.Providers, Workflow File ci.yml. The policy owner must own all three provider packages. (Private-repo policies are provisionally active for 7 days until the first successful publish locks them in.)
2. Add a NUGET_USER repo secret = your nuget.org profile name (username, not email).
3. The old NUGET_API_KEY secret can be deleted once this merges.

Test plan

• dotnet build -c Release — 0 warnings/errors
• dotnet test -c Release — 59/59 passing
• dotnet pack — .nupkg + .snupkg produced
• ci.yml validates as YAML
• First tag-triggered publish after nuget.org policy + NUGET_USER are set up