fix(middleware): map non-disconnect OperationCanceled to 504

[davidkallesen]

Summary

• Stop returning silent 200 OK with empty body on downstream timeouts
• Map non-disconnect OperationCanceledException to 504 Gateway Timeout
• Refresh ATC coding rules and bump analyzer/runtime/test dependencies

Changes

🐛 Fixes

• Gate silent OperationCanceledException arm on RequestAborted token
• Restore real error response on HttpClient.Timeout and CancelAfter
• Cover TaskCanceledException via existing resolver inheritance walk

✨ Features

• Add OperationCanceledException to default exception->status mappings
• Default mapping resolves to HTTP 504 Gateway Timeout
• Override per consumer via options.MapException(...) as before

📦 Dependencies

• Bump Atc 3.0.16 -> 3.0.67 across sample apps and test packages
• Bump Asp.Versioning.* 8.1 -> 10.0, Mapster 7.4 -> 10.0
• Bump EF Core InMemory 10.0.1 -> 10.0.7, MudBlazor 8.15 -> 9.4
• Bump OpenTelemetry.* 1.14 -> 1.15, Aspire.AppHost.Sdk 13.1 -> 13.2.4
• Bump Mvc.Testing 10.0.1 -> 10.0.7, NET.Test.Sdk 18.0.1 -> 18.5.1
• Bump xunit.v3.mtp-v2 3.2.1 -> 3.2.2, Atc.Test 2.0.16 -> 2.0.17

🔧 Configuration

• Update ATC coding rules to v1.0.1 in root, src, and test editorconfigs
• Add v1.1.0 editorconfig for the new sample/Demo.AppHost project
• Drop Asyncify and SecurityCodeScan.VS2019 from analyzer set
• Bump Atc.Analyzer 0.1.17 -> 0.1.23, Meziantou 2.0.267 -> 3.0.58
• Bump SonarAnalyzer.CSharp 10.17 -> 10.25

🎨 Styling

• Reformat sample sources to match new analyzer rules
• Reorganize GlobalUsings to absorb a Program.cs local using

📝 Documentation

• Expand XML doc on Invoke to describe the cancellation split

Notes

• Behaviour change for consumers relying on the silent-200 path; treat
  as a minor bump in release notes
• True upstream client disconnect (RequestAborted fired) still returns
  silently with no body written
• Telemetry on the swallowed-disconnect arm is intentionally deferred
  to a follow-up PR