Fix Snyk findings: drop AspNetCore 2.2.0 meta-package & bump AutoMapper

[kisst]

Addresses all Snyk SCA findings for this repo. Verified each fix with a real snyk test against the rebuilt dependency graph — the repo now scans clean (0 issues, down from 5).

Package	Before	After	Severity cleared
System.Text.Encodings.Web	4.5.0	(removed)	critical — RCE (CVE-2021-26701)
Microsoft.AspNetCore.Server.Kestrel.Core	2.2.0	(removed)	high — HTTP request smuggling (CVE-2025-55315)
Newtonsoft.Json	11.0.2	(removed)	high — insecure defaults (CVE-2024-21907)
Microsoft.AspNetCore.Server.IIS	2.2.0	(removed)	medium — open redirect (CVE-2019-1075)
AutoMapper	12.0.1	15.1.3	high — uncontrolled recursion (CVE-2026-32933)

Fix 1 — drop the Microsoft.AspNetCore 2.2.0 meta-package

All four transitive CVEs above traced back to the deprecated Microsoft.AspNetCore@2.2.0 meta-package, which pins ancient transitive versions. On net7.0 the ASP.NET Core framework is already supplied by the shared framework (implicit FrameworkReference from the Microsoft.NET.Sdk.Web SDK), so the explicit 2.2.0 PackageReference was both redundant and the sole source of these four findings. Removing it lets the app resolve against the patched net7 framework assemblies — no replacement package needed.

Fix 2 — bump AutoMapper 12.0.1 → 15.1.3

The only fix versions for the recursion CVE are 15.1.3 / 16.1.1, both major bumps. This required two small adjustments:

• Dropped AutoMapper.Extensions.Microsoft.DependencyInjection — that separate DI package was folded into the main AutoMapper package (and discontinued) as of v13.
• Updated the DI registration in Startup.cs from the removed marker-scanning overload AddAutoMapper(typeof(Startup)) to AddAutoMapper(cfg => cfg.AddProfile<MappingProfile>()). The mapping profile itself (CreateMap<TodoItem, TodoDynamo>().ReverseMap()) is unchanged.

Verification

• dotnet build -c Release — succeeds (each commit builds independently).
• App boots on the net7 shared framework and /api/health returns 200 with AutoMapper resolving through DI.
• snyk test — 0 issues (was 5: 1 critical, 3 high, 1 medium).

Snyk Code (SAST) is not enabled for the org, so no SAST pass; there are no IaC files in this repo to scan.

Note: a pre-existing CS1998 warning in HealthApiController.cs (async method without await) is unrelated to these security fixes and left for a separate change.