Fix security vulnerabilities and modernize the transfer API

[Jamalianpour]

Replace the 0.1.x wire protocol, which let any network client write files anywhere on the server and crash the server process.

Security fixes:

• Path traversal: the server joined SaveTo with the client-supplied file name, so "....\x" or an absolute path wrote outside the save folder. Names are now validated (no separators, drive letters, "..", control characters, ADS or device names) and must resolve inside SaveDirectory.
• Remote crash: malformed packets, duplicate names or early disconnects threw on a background thread and killed the process; EOF also caused infinite 100%-CPU loops. All connection errors are now contained.
• Unbounded allocation from untrusted length fields.
• Optional access-token auth (HMAC-SHA256 challenge, token never sent), optional TLS, and a SHA-256 integrity check on every transfer.
• Idle timeouts, a concurrent-connection limit, an optional max file size and a free-space check. Uploads go to a hidden temp file that is deleted on failure; existing files are never overwritten.

Modernization:

• Async API: EftClient.SendFileAsync/SendAsync with IProgress and cancellation; EftServer.Start/StopAsync with FileReceived and TransferFailed events. The 0.1.x API is kept as [Obsolete] wrappers.
• Remove the WarningsNotAsErrors list; the library builds warning-free.
• Convert the WinForms samples to SDK-style net10.0-windows projects (they referenced files deleted in the previous commit) and add token and progress UI.
• Add an xunit test project (72 tests on net8.0 and net10.0), a GitHub Actions CI workflow, Dependabot config, SECURITY.md and a new README.