fix: resolve NU1605 blocking TodoApp.Uno restore by bumping Uno.Sdk to 5.6.54

[adrianhall]

Summary

Resolves the NU1605 restore blocker for #506. CommunityToolkit.WinUI.Behaviors 8.2.250402 (pinned in samples/todoapp/TodoApp.Uno/Directory.Packages.props) floors Uno.WinUI at >= 5.5.87, but Uno.Sdk 5.4.5 (the previous global.json pin) resolves Uno.WinUI to 5.4.22, causing:

error NU1605: Detected package downgrade: Uno.WinUI from 5.5.87 to 5.4.22
  TodoApp.Uno -> CommunityToolkit.WinUI.Behaviors 8.2.250402 -> Uno.WinUI (>= 5.5.87)
  TodoApp.Uno -> Uno.WinUI (>= 5.4.22)

on every head (android, ios, maccatalyst, windows, browserwasm, desktop) - not just the desktop head #506 originally reported (confirmed in this comment).

Changes

• Bumped Uno.Sdk in samples/todoapp/TodoApp.Uno/global.json from 5.4.5 to 5.6.54 (the latest stable 5.x release), which resolves Uno.WinUI to 5.6.99, clearing the >= 5.5.87 floor. Confirmed via nupkg/nuspec inspection that this is the smallest Uno.Sdk change that stays within the current major version (avoids the larger 6.x migration effort called out in Investigate resolving NU1903 for Tmds.DBus in Uno desktop sample #506).
• Updated the NOTE comments in build-samples.yml and build-samples-todoapp-uno.yml to reflect the new state.

What this does NOT resolve

• The original NU1903 finding (Tmds.DBus 0.16.0, GHSA-xrw6-gwf8-vvr9) that Investigate resolving NU1903 for Tmds.DBus in Uno desktop sample #506 was filed for. Uno.WinUI.Runtime.Skia.X11 floats vulnerable Tmds.DBus 0.16.0 unchanged through the entire 5.x line (confirmed at 5.4.22, 5.5.87, 5.5.95, 5.6.99) and only switches to the patched Tmds.DBus.Protocol starting at Uno.WinUI 6.0.465 - a major-version bump. Filed as a follow-up: Major-version bump: Uno Platform 5 -> 6 (TodoApp.Uno sample) #524.
• A separate, pre-existing build failure on every Skia-based head (desktop, browserwasm, and almost certainly android/ios/maccatalyst), surfaced now that restore succeeds: CommunityToolkit.WinUI.Behaviors resolves a dev-prerelease Uno.Microsoft.Xaml.Behaviors.Interactivity.WinUI package on those heads (instead of the real Microsoft.Xaml.Behaviors.WinUI.Managed, which the windows head still gets), which appears to be missing the Microsoft.Xaml.Interactions.Core types used in Views/TodoListPage.xaml, causing UXAML0001/CS1061 build errors. This was never surfaced before because restore always failed first. Filed as a follow-up: TodoApp.Uno fails to build on Skia heads: EventTriggerBehavior could not be found #525.
• Two more NU1903 findings (System.Security.Cryptography.Xml 8.0.2) surfaced on the browserwasm head restore, also previously masked by NU1605. Filed as a follow-up: Investigate resolving NU1903 for System.Security.Cryptography.Xml in Uno browserwasm sample head #526.

Given the above, the todoapp-uno CI job (build-samples-todoapp-uno.yml) is intentionally left unwired in build-samples.yml - re-enabling it today would turn all-samples-built red on every future PR due to #525's build failure. It should be re-wired once #525 (at minimum) is resolved.

Validation

• dotnet restore samples/todoapp/TodoApp.Uno/TodoApp.Uno/TodoApp.Uno.csproj -p:TargetFramework=net10.0-desktop - succeeds, NU1605 gone, NU1903 (Tmds.DBus) warning still present as expected/documented.
• dotnet restore ... -p:TargetFramework=net10.0-windows10.0.26100 - succeeds cleanly, no NU1903 warnings (resolves the real Microsoft.Xaml.Behaviors.WinUI.Managed).
• dotnet restore ... -p:TargetFramework=net10.0-browserwasm - succeeds, surfaces the two System.Security.Cryptography.Xml NU1903 findings noted above (Investigate resolving NU1903 for System.Security.Cryptography.Xml in Uno browserwasm sample head #526).
• dotnet build ... -f net10.0-desktop - fails with the pre-existing EventTriggerBehavior bug (TodoApp.Uno fails to build on Skia heads: EventTriggerBehavior could not be found #525), unrelated to this change.
• Could not restore/build android/ios/maccatalyst locally (missing android/ios/maccatalyst workloads in this environment) - same limitation noted in PR fix: resolve NU1903 for Tmds.DBus.Protocol in Avalonia sample by bumping to 11.3.18 #508 for the Avalonia sample.
• dotnet build Datasync.Toolkit.sln --configuration Release (root solution, unaffected by this samples-only change) - succeeds, 0 warnings, 0 errors.

Follow-ups filed

• Major-version bump: Uno Platform 5 -> 6 (TodoApp.Uno sample) #524 - major-version bump (Uno 5 -> 6) needed to fully resolve the Tmds.DBus NU1903 finding.
• TodoApp.Uno fails to build on Skia heads: EventTriggerBehavior could not be found #525 - EventTriggerBehavior build failure on Skia heads, blocking CI re-enablement.
• Investigate resolving NU1903 for System.Security.Cryptography.Xml in Uno browserwasm sample head #526 - System.Security.Cryptography.Xml NU1903 finding on the browserwasm head.

Fixes #506