Fix stale CI workflows and add wildcard branch targeting

[KevinJump]

Why

The three GitHub Actions workflows only ever targeted v16/main (CodeQL also had v17/main) — none of them run against v18/main today. Investigating further, dotnet-build.yml and package-build.yml were also broken independently of branch targeting.

What changed

Real bugs fixed (not just stale branches):

• ./uSync.sln no longer exists (repo moved to uSync.slnx) — both workflows would fail to restore/build if triggered.
• dotnet-version: 9.0.x was pinned, but all projects target net10.0 — SDK 9 can't build them. Bumped to 10.0.x.
• ${{env.Config}} / ${{env.OUT_FOLDER}} don't match the declared env.config / env.out_folder keys — GitHub Actions' env context lookup is case-sensitive, so the schema-gen -c flag and the artifact-upload path were silently evaluating to empty.
• package-build.yml's package-up job referenced env.solution_name, which was only ever declared in the other job's env: block. Hoisted solution_name/test_project/schema_gen_project to workflow-level env so both jobs share them.
• The nuget pack list was missing uSync.Extend, uSync.AutoTemplates, and the root uSync meta-package, and had a Backoffice/BackOffice casing mismatch. Reconciled against dist/build-package.ps1, the current authoritative package list.
• GitVersion.yml's main-branch regex was ^v15\/main$ — hasn't matched an actual branch since v15. Updated to ^v[0-9]+\/main$ and bumped the (currently inert, tag-overridden) next-version fallback.

Future-proofing:

• All branch triggers now use "*/main" instead of a hardcoded list, so the next vNN/main branch picks these workflows up automatically with no manual bump.

Follow-up improvements (requested separately):

• Concurrency groups on all three workflows, so a new push/PR cancels the stale in-flight run instead of letting it finish pointlessly.
• paths-ignore: ["**.md", "docs/**"] so doc-only changes skip the full build/CodeQL/package pipeline.
• Pinned actions/setup-node@v4 (lts/*) on the workflows that build the client. Worth noting why this was needed even without explicit npm steps: uSync.Backoffice.Management.Client.csproj has an MSBuild target (NpmRunBuild, BeforeTargets="BeforeBuild") that shells out to npm run build automatically, so the plain dotnet build step was already implicitly depending on whatever Node happened to be preinstalled on the runner.
• Added .github/dependabot.yml grouping nuget/npm/github-actions bumps into one weekly PR per ecosystem, instead of the one-PR-per-dependency pattern in recent history.

What did NOT change

No dotnet nuget push / npm publish step was added anywhere — these workflows still only build and upload a review artifact, per explicit instruction not to auto-release to nuget.

Verification

• All edited/added YAML files parsed successfully with js-yaml (no linter available in this environment to actually execute the workflows).
• Cross-checked the nuget pack project list and exact folder casing against the filesystem and against dist/build-package.ps1.
• These are CI-only changes; no application code is touched.

🤖 Generated with Claude Code