Mark Microsoft.SourceLink.GitHub PrivateAssets=all so it is not a consumer dependency in the nuspec

[ken-swyfft]

NPOI 2.8.0 on nuget.org declares Microsoft.SourceLink.GitHub 8.0.0 as a dependency in all five TFM groups of its nuspec. SourceLink is a build-time-only package (it and Microsoft.Build.Tasks.Git both mark themselves developmentDependency=true), and NPOI even declares the edge with exclude="Build,Analyzers", so consumers never import anything from it. But dotnet restore audits the whole resolved graph regardless of asset exclusion. So on 2026-09-08, when GHSA-23fw-v26w-5fgq (CVE-2026-62900) was published against Microsoft.Build.Tasks.Git 8.0.0, every NPOI consumer that promotes NuGet audit warnings to errors went red on NU1902 through a node it never asked for and cannot use. #1866 moved this repo to 10.0.401, which clears today's advisory for the next release; this PR removes the root cause so the next advisory on that package line cannot reach consumers at all.

The leak comes from the umbrella solution/NPOI.Pack.csproj: its ProjectReferences are PrivateAssets="all", so the library projects contribute nothing to the nuspec, and every PackageReference in the Pack project itself becomes a consumer dependency unless it carries PrivateAssets="all". This PR adds that to the SourceLink reference there, and to the same reference in the four library projects for consistency, so a future change to how the package is assembled cannot reintroduce it.

Before / after, comparing the published 2.8.0 nuspec with dotnet pack solution/NPOI.Pack.csproj -c Release on this branch:

TFM group	published 2.8.0	this branch
net472, netstandard2.0, netstandard2.1, net8.0, net10.0	Microsoft.SourceLink.GitHub 8.0.0 present	absent

Every other dependency in every group is unchanged. SourceLink itself keeps working exactly as before: the package is still restored and its build assets still apply to each project; only the nuspec dependency entry disappears.

The same change has been in the swyfft-insurance fork since 2026-09-09 (swyfft-insurance#5), where the rebuilt package was verified against a consumer solution of about 180 projects: neither SourceLink package nor Microsoft.Build.Tasks.Git appears anywhere in the resolved graph any more.

(PR opened by Claude, an AI assistant, on Ken's behalf.)

[ken-swyfft]

The windows-latest failure here is the pre-existing Windows file-sharing race in the test infrastructure, not this change. One test failed, Bug59058 (NPOI.OOXML.TestCases, net10.0), with:

System.IO.IOException : The process cannot access the file '...\testcases\test-data\document\bug59058.docx' because it is being used by another process

Bug59058 opens its files through POIDataSamples.GetDocumentInstance().GetFile(), which uses FileMode.OpenOrCreate (ReadWrite access + FileShare.Read). The net472 and net10.0 test hosts run in parallel under Nuke, so whichever host opens the file second is refused. #1867 fixes exactly that opener (read-only + FileShare.ReadWrite), and its own windows-latest run was green.

The other five assembly/TFM combinations in this run all passed (net472: 2804 / 1866 / 79; net10.0: 2801 / 79), and ubuntu-latest is green. This PR changes only PackageReference metadata that affects nuspec generation; it does not touch test code or runtime behaviour. A re-run should be green, but I don't have permission to trigger one on this repo.

(Comment by Claude, an AI assistant, on Ken's behalf.)

[tonyqus]

LGTM