Update .NET dependencies [ALLOW INTERMEDIATE BUILDS]

[kate-goldenring]

What this PR does / why we need it:

Snyk reported some vulnerabilities in our .NET dependencies. This updates them to their latest versions. The result was an overall reduction in vulnerabilities and a decrease in the size of the OPENCV container (by ~100MB) and ONVIF broker (by ~100MB).

Special notes for your reviewer:

Summary of .NET vulnerabilities in samples

akri/samples/brokers/onvif-video-broker

No vulnerabilities
Output of snyk test

Organization:      kate-goldenring
Package manager:   nuget
Target file:       obj/project.assets.json
Project name:      onvif-video-broker
Open source:       no
Project path:      /home/kagold/akri-fork/samples/brokers/onvif-video-broker
Licenses:          enabled

✔ Tested 40 dependencies for known issues, no vulnerable paths found.

akri/samples/brokers/opcua-monitoring-broker

Before updating, Snyk found 12 issues. This was reduced to 4 after updating dependencies.
All 4 vulnerabilities come from OPCFoundation.NetStandard.Opc.Ua. Some persisted even after updating to the latest version. OPCFoundation.NetStandard.Opc.Ua must update the versions of System.Text.RegularExpressions, System.IO.Pipelines, and System.Text.Encodings.Web to remove some of the vulnerabilities. And the first vulnerability recommends a use pattern. This OPC UA broker is only used for samples/demos and is not for production cases.

Output of snyk test:

✗ Medium severity vulnerability found in OPCFoundation.NetStandard.Opc.Ua
  Description: Improper Certificate Validation
  Info: https://snyk.io/vuln/SNYK-DOTNET-OPCFOUNDATIONNETSTANDARDOPCUA-1075446
  Introduced through: [email protected]
  From: [email protected]

✗ High severity vulnerability found in System.Text.RegularExpressions
  Description: Regular Expression Denial of Service (ReDoS)
  Info: https://snyk.io/vuln/SNYK-DOTNET-SYSTEMTEXTREGULAREXPRESSIONS-174708
  Introduced through: [email protected], [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  and 25 more...
  Fixed in: 4.3.1

✗ High severity vulnerability found in System.IO.Pipelines
  Description: Denial of Service (DoS)
  Info: https://snyk.io/vuln/SNYK-DOTNET-SYSTEMIOPIPELINES-72389
  Introduced through: [email protected], [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  and 9 more...
  Fixed in: 4.5.1

✗ Critical severity vulnerability found in System.Text.Encodings.Web
  Description: Remote Code Execution (RCE)
  Info: https://snyk.io/vuln/SNYK-DOTNET-SYSTEMTEXTENCODINGSWEB-1253267
  Introduced through: [email protected], [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  and 29 more...
  Fixed in: 4.5.1, 4.7.2, 5.0.1



Organization:      kate-goldenring
Package manager:   nuget
Target file:       obj/project.assets.json
Project name:      opcua-monitoring-broker
Open source:       no
Project path:      /home/kagold/akri-fork/samples/brokers/opcua-monitoring-broker
Licenses:          enabled

Tested 127 dependencies for known issues, found 4 issues, 73 vulnerable paths.

akri/samples/opcua-certificate-generator

One additional pipeline dependency was added by increasing the dependency OPCFoundation.NetStandard.Opc.Ua version. As with the opcua-monitoring-broker, all dependencies come from OPCFoundation.NetStandard.Opc.Ua.

✗ Medium severity vulnerability found in OPCFoundation.NetStandard.Opc.Ua
  Description: Improper Certificate Validation
  Info: https://snyk.io/vuln/SNYK-DOTNET-OPCFOUNDATIONNETSTANDARDOPCUA-1075446
  Introduced through: [email protected]
  From: [email protected]

✗ High severity vulnerability found in System.Text.RegularExpressions
  Description: Regular Expression Denial of Service (ReDoS)
  Info: https://snyk.io/vuln/SNYK-DOTNET-SYSTEMTEXTREGULAREXPRESSIONS-174708
  Introduced through: [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  and 11 more...
  Fixed in: 4.3.1

✗ High severity vulnerability found in System.IO.Pipelines
  Description: Denial of Service (DoS)
  Info: https://snyk.io/vuln/SNYK-DOTNET-SYSTEMIOPIPELINES-72389
  Introduced through: [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  and 3 more...
  Fixed in: 4.5.1

✗ Critical severity vulnerability found in System.Text.Encodings.Web
  Description: Remote Code Execution (RCE)
  Info: https://snyk.io/vuln/SNYK-DOTNET-SYSTEMTEXTENCODINGSWEB-1253267
  Introduced through: [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  From: [email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
  and 13 more...
  Fixed in: 4.5.1, 4.7.2, 5.0.1



Organization:      kate-goldenring
Package manager:   nuget
Target file:       obj/project.assets.json
Project name:      opcua-certificate-generator
Open source:       no
Project path:      /home/kagold/akri-fork/samples/opcua-certificate-generator
Licenses:          enabled

Tested 108 dependencies for known issues, found 4 issues, 37 vulnerable paths.

If applicable:

• version has been updated appropriately (./version.sh)
• all commits pass the DCO bot check by being signed off -- see the failing DCO check for instructions on how to retroactively sign commits