Test project resolves SQLitePCLRaw 2.1.11 (SQLite 3.49.1, CVE-2025-6965) through the EF Core 10.0.0 floor #202

Dependabot alert #53: GHSA-2m69-gcr7-jv3q / CVE-2025-6965, high. SQLite before 3.50.2 can corrupt memory when a query has more aggregate terms than there are columns.

Where it comes from. The test project pins Microsoft.EntityFrameworkCore.Sqlite at the 10.0.0 floor (#133). That brings SQLitePCLRaw.bundle_e_sqlite3 2.1.11, so SQLitePCLRaw.lib.e_sqlite3 2.1.11 ships SQLite 3.49.1. The advisory covers <= 2.1.11 and lists no patched version, so Dependabot cannot open a PR. SQLitePCLRaw 2.1.12 (2026-07-19) and later ship SQLite 3.53.x.

Who is affected. Only the test project. None of the three packages under src/ references SQLite, so consumers get nothing from us. A consumer on Microsoft.EntityFrameworkCore.Sqlite 10.0.0 has the same exposure through EF Core itself. EF Core 10.0.14 already depends on 2.1.13.

Fix. Reference SQLitePCLRaw.bundle_e_sqlite3 2.1.14 (the newest 2.x) directly in the test project, on the floor build only. EF Core and Microsoft.Data.Sqlite stay at 10.0.0. The EfFloat lane drops the pin, since the patch it floats to brings its own SQLitePCLRaw and a lower direct pin would fail that restore with NU1605. Tell Dependabot to ignore SQLitePCLRaw majors: 3.x renames the native package, and Microsoft.Data.Sqlite 10 is built against 2.x.

Lands on main first, then is cherry-picked into release/5.x, which has the same reference.