Fix QuicStream send buffer leak - #135591

.NET 10.0.13 (13 October 2026) is a security release with 44 CVEs,
including CVE-2026-105016, a remote code execution vulnerability in
Microsoft QUIC that MSRC rates Critical for .NET installed on Windows.
Runtime 10.0.13 bundles msquic.dll 2.5.11; 10.0.12 bundled 2.5.10. The
one-week cooldown is skipped for this release.

global.json and the workflows' dotnet-version pins move to SDK 10.0.402.
The MAUI workload set stays at 10.0.401: a workload set belongs to the
10.0.400 feature band, and none was published for 10.0.402.

The shipped dependency minimums move from 10.0.12 to 10.0.13:
System.Threading.RateLimiting (core), System.Text.Json (core .NET Standard
2.0 asset), and Microsoft.Extensions.DependencyInjection and
Microsoft.Extensions.Hosting.Abstractions (DI package). Every lock file is
regenerated with SDK 10.0.402, and each change is a 10.0.12 to 10.0.13
move, including the implicit Microsoft.NET.ILLink.Tasks and ILCompiler
references. The MAUI locks need the workload to regenerate, so they mirror
the same two entries with the hashes NuGet recorded in the core lock.
coverlet.MTP's Microsoft.Extensions.Configuration dependencies stay at the
10.0.12 it requests.

The test probes that pin an exact runtime (RuntimeCloseProbe,
AppContainerSmoke and the native dependency probe template) move to
10.0.13, so they exercise the runtime the repository now builds with.

The docs record what the release contains. The macOS accept fix for
dotnet/runtime#121848 (backport #133567) ships in 10.0.13; EmbedIO keeps
its IPv6 accept worker. The System.Net.Quic send-buffer fix
(dotnet/runtime#135591) is not in 10.0.13. CONTRIBUTING, SECURITY, the
MAUI validation guide and the changelog describe the new pins.

.NET 10.0.13 (13 October 2026) is a security release with 44 CVEs,
including CVE-2026-105016, a remote code execution vulnerability in
Microsoft QUIC that MSRC rates Critical for .NET installed on Windows.
Runtime 10.0.13 bundles msquic.dll 2.5.11; 10.0.12 bundled 2.5.10. The
one-week cooldown is skipped for this release.

global.json and the workflows' dotnet-version pins move to SDK 10.0.402.
The MAUI workload set stays at 10.0.401, a set of the 10.0.400 feature
band, so the MAUI apps keep the 10.0.12 Mono runtime. Workload set 10.0.402
carries 10.0.13 but moves the Apple packs to the Xcode 27.0 release; that
move is a separate change.

The shipped dependency minimums move from 10.0.12 to 10.0.13:
System.Threading.RateLimiting (core), System.Text.Json (core .NET Standard
2.0 asset), and Microsoft.Extensions.DependencyInjection and
Microsoft.Extensions.Hosting.Abstractions (DI package). Every lock file is
regenerated with SDK 10.0.402. Each resolved version change is 10.0.12 to
10.0.13, including the implicit Microsoft.NET.ILLink.Tasks and ILCompiler
references; the dependency-free HttpsCertificates lock also moves from
format version 1 to 2. The MAUI locks need the workload to regenerate, so
they mirror the same two entries with the hashes NuGet recorded in the core
lock. coverlet.MTP's Microsoft.Extensions.Configuration dependencies stay
at the 10.0.12 it requests.

The test probes that pin an exact runtime (RuntimeCloseProbe,
AppContainerSmoke and the native dependency probe template) move to
10.0.13, so they exercise the runtime the repository now builds with.

The docs record what the release contains. The macOS accept fix for
dotnet/runtime#121848 (backport dotnet/runtime#133567) ships in
10.0.13; EmbedIO keeps its IPv6 accept worker. The System.Net.Quic
send-buffer fix (dotnet/runtime#135591) is not in 10.0.13. CONTRIBUTING,
SECURITY, the MAUI validation guide and the changelog describe the new
pins.