build: update NuGet dependencies (#2198)

- ReactiveUI.Primitives 5.8.0 -> 6.0.0
- TUnit 1.57.0 -> 1.58.0
- Microsoft.VisualStudio.Threading.Analyzers 17.14.15 -> 18.7.23
- SonarAnalyzer.CSharp 10.27.0.140913 -> 10.28.0.143324

Disable SonarAnalyzer S5332 (insecure http) in the test tree: the newer
Sonar release flags test-only http:// URLs that are not real endpoints.

Legacy System.* (4.x) and the held-back Microsoft.CodeAnalysis.* Roslyn
toolchain are intentionally left unchanged per renovate.json; the
framework-aligned ASP.NET / Extensions / System.Text.Json bands are
already at their latest patch.

Author: glennawatson

src/Directory.Packages.props

@@ -5,8 +5,8 @@
   </PropertyGroup>
 
   <PropertyGroup Label="Shared Version Variables">
-    <PrimitivesVersion>5.8.0</PrimitivesVersion>
-    <TUnitVersion>1.57.0</TUnitVersion>
+    <PrimitivesVersion>6.0.0</PrimitivesVersion>
+    <TUnitVersion>1.58.0</TUnitVersion>
   </PropertyGroup>
 
   <PropertyGroup Label="Framework-Aligned Versions">
@@ -21,7 +21,7 @@
     <MicrosoftCodeAnalysisWorkspacesVersion>4.14.0</MicrosoftCodeAnalysisWorkspacesVersion>
 
     <SourceLinkVersion>10.0.300</SourceLinkVersion>
-    <ThreadingAnalyzersVersion>17.14.15</ThreadingAnalyzersVersion>
+    <ThreadingAnalyzersVersion>18.7.23</ThreadingAnalyzersVersion>
     <NetFrameworkReferenceAssembliesVersion>1.0.3</NetFrameworkReferenceAssembliesVersion>
   </PropertyGroup>
 
@@ -43,7 +43,7 @@
   <ItemGroup Label="Analyzers">
     <PackageVersion Include="StyleSharp.Analyzers" Version="3.13.4"/>
     <PackageVersion Include="Roslynator.Analyzers" Version="4.15.0"/>
-    <PackageVersion Include="SonarAnalyzer.CSharp" Version="10.27.0.140913"/>
+    <PackageVersion Include="SonarAnalyzer.CSharp" Version="10.28.0.143324"/>
     <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="$(MicrosoftCodeAnalysisAnalyzersVersion)"/>
     <PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="5.0.0-1.25277.114"/>
   </ItemGroup>

src/tests/.editorconfig

@@ -11,3 +11,8 @@ dotnet_diagnostic.CA1063.severity = none # Implement IDisposable correctly
 dotnet_diagnostic.CA1065.severity = none # Do not raise exceptions in unexpected locations
 dotnet_diagnostic.CA1812.severity = none # Avoid uninstantiated internal classes (test fixtures/DTOs)
 dotnet_diagnostic.CA2213.severity = none # Disposable fields should be disposed
+
+###################
+# SonarAnalyzer (S) — relaxed for test projects
+###################
+dotnet_diagnostic.S5332.severity = none # Using http protocol is insecure (test URLs are not real endpoints)