Exclude unused Kafka libraries and update .NET to 10.0.13

[boblangley]

The Windows installer packages libcurl 8.19.0 through RavenDB's native Kafka client dependencies. That curl version has published vulnerabilities. ServiceControl does not configure RavenDB's Kafka ETL or sink tasks, and the bundled RavenDB license reports both queue features disabled.

Exclude libcurl.dll, librdkafka.dll, and its C++ companion librdkafkacpp.dll from RavenDBServer.zip. The other server files and dependency manifests remain intact. Kafka functionality would require these native dependencies if enabled. Normal instance upgrades replace the installation directory, so they also remove the excluded DLLs.

Add a Windows installation engine test that extracts the actual embedded ZIP and starts its self-contained Raven.Server.exe. It checks the excluded DLLs, writes and reads a document, queries a static index, and repeats the read/query after restarting the server. This runs in Windows-DefaultCore; existing Windows-Raven tests use the separate server supplied by RavenDB.Embedded.

Update RuntimeFrameworkVersion to 10.0.13 to unblock NuGet audit and keep the packaged Microsoft assemblies aligned with the shared runtime. Microsoft identifies PKCS 10.0.13 as the patched version for CVE-2026-70162 and CVE-2026-84008. Pin the transitive Microsoft.Extensions.FileProviders.Embedded dependency to the same runtime version. NuGet audit and assembly-version checks remain enabled.

The implementation follows Packaging and Deployment. The PR records the exclusion rationale; the documentation describes the resulting package and test coverage.

Validation

• Cross-compiled ServiceControlInstaller.Engine.UnitTests and its project graph on macOS with EnableWindowsTargeting=true and NuGet audit enabled: no warnings or errors.
• Ran all 18 installation packaging tests against an isolated .NET/ASP.NET Core 10.0.13 runtime on macOS: all passed, including the assembly-version checks.
• The Windows installation engine suite passed in CI run 38606689139, including the new packaged-RavenDB test. The three skipped tests were existing explicit/manual tests.
• Inspected the generated ZIP built from the released RavenDB 6.2.18 Windows server: all three DLLs are absent and Raven.Server.exe is present.
• An isolated Linux RavenDB 6.2.18 smoke check with the equivalent native Kafka libraries and libcurl removed passed startup, database creation, document writes/reads, indexing, and persistence across restart.

The first CI run stopped at restore on PKCS audit findings also present on master. A PKCS-only update cleared restore but failed the existing shared-runtime assembly-version checks; the runtime update resolves that mismatch. The same run also hit an Azure CLI Python import deadlock, a Linux RavenDB request timeout, and an MSSQL container port collision. These failures occurred outside the packaged Windows server test and will be checked in the next run.