Attach-time minTLS for R2 custom domains (3.5.0) + build fixes

[alexis-]

Changes

Feature (3.5.0):

• AttachCustomDomainAsync gains an optional minTls parameter (serialized as minTLS in the request body) so the minimum TLS version can be pinned at attach time instead of a follow-up UpdateCustomDomainAsync call. The Cloudflare API defaults new custom domains to TLS 1.0.
• Unit test asserting the request-body serialization, plus a live integration test (AttachCustomDomainAsync_WithMinTls_AppliesMinimumTlsVersion) that attaches with minTls 1.2 and reads the applied value back via ListCustomDomainsAsync - verified green against the live API.
• Version bump: Cloudflare.NET.Api 3.4.0 -> 3.5.0.

Build/deps:

• Local Directory.Packages.props opting out of Central Package Management, so the repo builds cleanly when vendored as a git submodule inside a CPM monorepo (fixes NU1008 without -p: overrides).
• WireMock.Net 1.20.0 -> 2.13.0: drops the vulnerable transitive Scriban.Signed 5.5.0 (1 critical + several high advisories that fail the NuGet audit under TreatWarningsAsErrors) for 7.2.5. Microsoft.Extensions.* test references aligned to 10.0.0, one WireMock 2.x nullability fixup.

Verification

• Full solution builds with zero property overrides, zero NuGet audit warnings.
• 1087/1088 tests green locally (1 credential-gated skip), including the WireMock-backed resilience pipeline tests.

Note

CI currently has 7 pre-existing live-API integration failures unrelated to this change (account management x2, DNS import/export x2, zone holds, KV bulk delete, R2 multipart duplicate-part) - Cloudflare API drift, same category as b551347.