chore(deps): land safe bumps and split renovate groups

[kaybi-gh]

Summary

• Lands the easy minor/patch NuGet and tool bumps from the blocked Renovate PRs, without MediatR 12.5 (breaks RequestHandlerDelegate in tests).
• Drops unused CPM pins leftover from the template (SQL Server, Identity.UI, FluentValidation.AspNetCore, MAUI Compatibility, Azure.Identity, MessagePack, etc.).
• Splits Renovate into tight must-bump-together groups so one breaking update cannot block the rest. Disables Microsoft.OpenApi 3.x and FluentAssertions 8+ majors.

Supersedes #49, #51, and #52.

Test plan

• CI build-and-test is green
• Identity still registers (IdentityNoOpEmailSender no-ops email)
• After merge, run Actions -> Renovate -> Run workflow so the old grouped branches are recreated as smaller PRs
• Confirm leftover majors (MediatR 12.5/14, TMDbLib 3, SkiaSharp 4, FluentAssertions 8, Test.Sdk 18) appear as isolated PRs