Pin patched transitive dependencies in test project to remediate xUnit 2.4.1 vulnerability path

[Copilot]

The issue flags vulnerable transitive packages pulled through xunit 2.4.1 (System.Text.RegularExpressions and System.Net.Http). This change remediates that path by explicitly pinning safe package versions in the test project.

• Dependency remediation

  • Added direct PackageReference entries in src/DecimalChecker.Tests/DecimalChecker.Tests.csproj:
    • System.Text.RegularExpressions → 4.3.1
    • System.Net.Http → 4.3.4
  • Kept existing xUnit/test SDK versions unchanged; only override vulnerable transitive resolution.

• Scope

  • Single-file change, limited to test project dependency graph.
  • No production code changes.

<ItemGroup>
  <PackageReference Include="System.Net.Http" Version="4.3.4" />
  <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
</ItemGroup>