fix(security): override SQLite native to 3.50.4 — fix CVE-2025-6965 (#48)

Microsoft.Data.Sqlite 10.0.9 transitively pins SQLitePCLRaw 2.1.11, whose
bundled e_sqlite3 is SQLite < 3.50.2 — vulnerable to CVE-2025-6965 (GHSA-2m69
-gcr7-jv3q, high, memory corruption when aggregate terms exceed available
columns). Add a direct reference to SQLitePCLRaw.bundle_e_sqlite3 3.0.3, which
ships SQLite 3.50.4.5, dropping the vulnerable lib.e_sqlite3 from the graph.

Verified: dotnet restore clears NU1903 with no version-downgrade conflicts;
Release build clean (0 warnings); runtime smoke test confirms M.D.Sqlite 10.0.9
binds to SQLitePCLRaw core 3.0.3 and the DELETE ... RETURNING atomic-claim
pattern works (SELECT sqlite_version() reports 3.50.4).

Author: JacobHaig

Wisbot.csproj

@@ -19,6 +19,10 @@
          separate change gated on a voice smoke test (see docs/security audit). -->
     <PackageReference Include="Discord.Net" Version="3.19.0-beta.1" />
     <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.9" />
+    <!-- Override the SQLite native to fix CVE-2025-6965 (SQLite < 3.50.2 memory
+         corruption). Microsoft.Data.Sqlite 10.0.9 transitively pins the vulnerable
+         SQLitePCLRaw 2.1.11 (e_sqlite3); the 3.0.x bundle ships SQLite 3.50.4.5. -->
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
     <PackageReference Include="Minio" Version="7.0.0" />
     <PackageReference Include="NAudio" Version="2.3.0" />
     <!-- Native libraries for Discord voice support.