fix: resolve OpenApi/NPOI vulnerable package and all build warnings

[KrzysztofPajak]

Summary

• Downgrade Microsoft.OpenApi 3.10.2 -> 2.12.2: Microsoft.AspNetCore.OpenApi 10.0.12 (current .NET 10 release) requires OpenApi <3.0.0; its source generator targets the 2.x API surface where IOpenApiMediaType.Example is writable, causing CS0200 build errors against OpenApi 3.x.
• Pin transitive Microsoft.Build.Tasks.Git to 10.0.401 (moderate CVE GHSA-23fw-v26w-5fgq) via a direct PackageReference in Grand.Business.Common (pulled in by ExcelMapper -> NPOI -> Microsoft.SourceLink.GitHub 8.0.0; NPOI 2.8.0 is already latest so it can't be bumped further).
• CS8632: add missing #nullable enable to 10 test files that already used nullable annotations without the pragma.
• CS0618: remove the now-redundant PowerExcelExtensions.Rows(ISheet) extension — NPOI 2.8.0's ISheet implements IEnumerable<IRow> natively; fix the obsolete RedisConnectionException constructor call in a test.
• CS8604: widen IReportDataScope.CanIncludeProduct to Product? — passing null is the documented, intentional fail-closed signal for Vendor's scope.
• CS9107/CS9124: eliminate the double-capture of primary-constructor parameters that are both forwarded to base() and reused by the derived controller, across the Tax/Discount/EmailAccount/MessageTemplate/OnlineCustomer/Reports/Order/Blog/News/Page Base*Controller hierarchy — reuse each base's already-established protected accessor pattern instead of re-capturing the parameter in the derived class.

Test plan

• Full solution build: 0 errors, 1 pre-existing unrelated warning (ASPIRE010).
• dotnet list ... --vulnerable across the whole solution: 0 vulnerable packages.
• Grand.Web.Admin.Tests (1479), Grand.Web.Store.Tests (158), Grand.Infrastructure.Tests (155), Grand.Business.Common.Tests (127) all pass.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.