docs: document secure UnsafeEntityLogging default in datasync-server sample (#477)

[adrianhall]

Summary

Closes #477.

Reviews samples/datasync-server/src/Sample.Datasync.Server against the UnsafeEntityLogging option added in v10.1.0 (#446) and explicitly documents the secure default.

Changes

• Controllers/TodoItemController.cs: previously had no Options configured (implicit default). Now explicitly sets Options = new TableControllerOptions { UnsafeEntityLogging = false } with a comment explaining that TodoItem.Title is user-supplied content, so the sample intentionally keeps entity logging disabled.
• Controllers/TodoListController.cs: already set Options = new TableControllerOptions { EnableSoftDelete = true }. Extended it with the same explicit UnsafeEntityLogging = false and comment, since TodoList.Title is also user-supplied content.
• Sample.Datasync.Server.csproj: bumped Microsoft.AspNetCore.OpenApi, Microsoft.EntityFrameworkCore.SqlServer, and Microsoft.EntityFrameworkCore.Tools from 10.0.3 to 10.0.9 to resolve a NU1605 package-downgrade error that was breaking the sample build against the repo's currently centrally-managed dotnet 10 version (DotNetVersion in Directory.Packages.props). Resolving that surfaced a further CS1705 assembly version conflict on Microsoft.OData.Edm/Microsoft.OData.Core (a transitive dependency via Microsoft.AspNetCore.OData), so those are now pinned to 8.4.3 as well, matching the Microsoft.Spatial pin already used by CommunityToolkit.Datasync.Server.Abstractions and the ODataVersion used in the root Directory.Packages.props. These build-fix changes were pre-existing and unrelated to UnsafeEntityLogging, but were needed to satisfy the issue's "sample builds and runs against v10.1.0" acceptance criterion.

This mirrors the pattern already used for the todoapp-mvc sample (#480/#485) and the todoapp-tutorial sample (#476/#487).

Acceptance criteria

• UnsafeEntityLogging remains false (default) in this sample.
• A comment documents the deliberate secure default where TableControllerOptions is configured (both controllers).
• The sample builds and runs against v10.1.0.

Testing

• dotnet build samples/datasync-server/src/Sample.Datasync.Server/Sample.Datasync.Server.csproj — succeeds with 0 errors (previously failed with NU1605/CS1705 before the version pins were added).
• dotnet restore Datasync.Toolkit.sln / dotnet build Datasync.Toolkit.sln — succeed with 0 errors.
• dotnet test tests/CommunityToolkit.Datasync.Server.Test/CommunityToolkit.Datasync.Server.Test.csproj — 2280 passed, 0 failed, 465 skipped (live/container-dependent tests, unaffected by this change).