Fix CI: remove ImageSharp.Drawing, resolve NU1903 vulnerable packages
Unblocks CI, which currently fails on every PR, from two independent causes:
Remove SixLabors.ImageSharp.Drawing
The package was referenced by Rdmp.Core and Tests.Common but its only actual usage was two one-line solid-colour fills in test code. Both rewritten with core ImageSharp APIs; package reference removed entirely.
Context: ImageSharp.Drawing 3.x (and ImageSharp 4.x) enforce a Six Labors commercial license key at build time, which is why the dependabot bump in #215 failed. With Drawing removed there is nothing left of that package to bump. Core ImageSharp stays on 3.1.x for now; the 4.x upgrade needs a proper decision (remove the dependency or obtain an open source license key from Six Labors) — tracked separately.
Fix NU1903 warning-as-error vulnerable packages
NuGet audit failures blocked restore on every PR branched from main:
- SSH.NET 2025.1.0 -> 2026.0.0 (GHSA-q939-rpr3-3284, high)
- System.Security.Cryptography.Xml 10.0.7 -> 10.0.11 (GHSA-23rf-6693-g89p, GHSA-8q5v-6pqq-x66h, GHSA-cvvh-rhrc-wg4q, GHSA-g8r8-53c2-pm3f, GHSA-mmjf-rqrv-855v)
- Microsoft.Data.Sqlite pinned to 10.0.11, pulling SQLitePCLRaw >= 2.1.12 (GHSA-2m69-gcr7-jv3q, transitive via FAnsiSql.Legacy -> FAnsiSql.Sqlite)
Verification
- dotnet restore: 0 NU1903 (was 7)
- Release build: 0 errors, no new warnings (remaining 3 warnings are the NPOI OSMF EULA notices, addressed separately)
- MetadataReportTests + DocumentationReportDatabaseEntities suites: 34/34 passed locally