chore: require manual Roslyn minor and major upgrades

[vicancy]

Summary

Keep routine Roslyn patch updates eligible for Dependabot, but require manual review for minor and major upgrades.

• Ignore version-update:semver-minor and version-update:semver-major for Microsoft.CodeAnalysis and Microsoft.CodeAnalysis.*.
• Preserve the existing Roslyn group and all current package versions.
• Restore a valid, non-overlapping NuGet update block using the correction already proposed in chore: Fix dependabot.yml #10951: remove the invalid duplicate root block and keep Verify.* updates manual.
• Leave npm and GitHub Actions update policies unchanged.

Why

#11124 intentionally uses Roslyn 5.6 for net8.0/net9.0 and 5.9 for the newer target. #11148 repeats the incompatible 5.6 -> 5.9 update for the older targets, as did the closed #11118 and #11129.

Dependabot ignore rules are package-level, not target-framework-level. This is a deliberate tradeoff: routine Roslyn minor/major upgrades for net10.0 also become manual. Patch updates remain allowed by policy; this does not claim independent scheduling for each conditional PackageVersion entry.

These update-type ignores apply to version updates, not security-only updates. They do not disable vulnerability alerts or suppress security update review.

Validation

• The previous file fails YAML parsing at the nested second NuGet block.
• The proposed file parses and validates against the SchemaStore Dependabot 2.0 schema.
• Three ecosystem/directory/target combinations are unique.
• Local policy assertions cover all eight compiler/workspace packages: compatible patch versions are allowed, while minor and major transitions are ignored (48 cases).
• Unrelated npm/GitHub Actions policies and NuGet groups remain unchanged.
• Checked the update-type semantics against Dependabot::Config::IgnoreCondition and its upstream tests.

These are local schema and policy-intent checks, not a hosted Dependabot update run. The new policy takes effect only after merge.

Related: #11148, #11124, #10951.