Use NuGet/login in CI and bump dependencies

[dsanchezcr]

Replace manual OIDC token retrieval with NuGet/login@v1 in the GitHub Actions workflow and use its NUGET_API_KEY output for dotnet nuget push; add packages: write permission. Add permissions: read-all to the CodeQL workflow. Update test project packages (xunit.runner.visualstudio 2.8.2 -> 3.1.5, coverlet.collector 6.0.4 -> 8.0.0) and bump System.Text.Json in the main project (8.0.6 -> 10.0.3). These changes simplify NuGet authentication and bring dependencies up to newer supported versions.

[Copilot]

Pull request overview

Simplifies CI publishing by switching NuGet authentication to NuGet/login@v1, adjusts GitHub Actions permissions, and bumps several .NET package dependencies for the NuGet library and its tests.

Changes:

• Replace manual NuGet OIDC token retrieval with NuGet/login@v1 and use its output for dotnet nuget push.
• Update workflow permissions (add packages: write where needed; add workflow-level read-all to CodeQL).
• Bump .NET dependencies: System.Text.Json (library) and xunit.runner.visualstudio / coverlet.collector (tests).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/NuGet/ColonesExchangeRate/ColonesExchangeRate.csproj	Bumps System.Text.Json dependency version.
src/NuGet/ColonesExchangeRate.Tests/ColonesExchangeRate.Tests.csproj	Updates test runner/coverage collector package versions.
.github/workflows/workflow.yaml	Switches NuGet publish auth to NuGet/login@v1 and updates job permissions for publishing.
.github/workflows/codeql.yml	Adds workflow-level permissions configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

xunit.runner.visualstudio was bumped to a new major version (3.1.5) while the test framework package is still xunit 2.9.3. This combination is likely incompatible and can result in tests not being discovered/run by dotnet test. Align the major versions (either keep the runner/adapter on the v2 line, or migrate the test framework to the matching major version).

[dsanchezcr]

@copilot open a new pull request to apply changes based on this feedback

[Copilot]

permissions: read-all at the workflow level is redundant here because the analyze job defines its own explicit permissions block (which overrides the workflow-level setting). Keeping read-all also increases the default token scope for any future jobs added without explicit permissions; consider removing the workflow-level read-all and relying on the job’s least-privilege permissions instead.

Suggested change

permissions: read-all

[dsanchezcr]

@copilot removing permissions will cause CodeQL can't run the static analysis.

[Copilot]

@dsanchezcr I've opened a new pull request, #42, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

@dsanchezcr I've opened a new pull request, #43, to work on those changes. Once the pull request is ready, I'll request review from you.