`NU1903`: Transitive dependency `Snappier` 1.2.0 contains a known high-severity vulnerability

## Description

Elsa introduces a transitive dependency on `Snappier` 1.2.0, which contains a known **high-severity security vulnerability** ([GHSA-pggp-6c3x-2xmx](https://github.com/advisories/GHSA-pggp-6c3x-2xmx)). Projects that treat NuGet warnings as errors (e.g. via `` or ``) will fail to build with error `NU1903`.

```
error NU1903: Package 'Snappier' 1.2.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-pggp-6c3x-2xmx
```

## Steps to Reproduce

1. Create a new .NET project and add a reference to the Elsa package (see version below).
2. Ensure `true` is set in the project file (or that NU1903 is treated as an error via ``).
3. Run `dotnet restore` or `dotnet build`.

**Reproduction Rate:** Every time.

## Expected Behavior

Elsa should not depend on a package with a known high-severity vulnerability. The dependency on `Snappier` should be updated to a version that is not affected by [GHSA-pggp-6c3x-2xmx](https://github.com/advisories/GHSA-pggp-6c3x-2xmx).

## Actual Behavior

The build fails with:

```
error NU1903: Package 'Snappier' 1.2.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-pggp-6c3x-2xmx
```

The vulnerability is introduced transitively via Elsa and is not directly referenced by the consuming project.

## Environment

- **Elsa Package Version:** 3.6.1
- **Operating System:** macOS (Apple Silicon)
- **.NET SDK Version:** 10.0.100

## Log Output

```
error NU1903: Package 'Snappier' 1.2.0 has a known high severity vulnerability,
https://github.com/advisories/GHSA-pggp-6c3x-2xmx
```

Identified via:
```bash
dotnet nuget why .csproj Snappier
```

## Troubleshooting Attempts

- Confirmed via `dotnet nuget why` that `Snappier` 1.2.0 is pulled in transitively through Elsa and is not a direct dependency of the affected project.
- Workaround: explicitly adding `` to the project file overrides the transitive version and resolves the build error, but this should not be necessary in consuming projects.