fix: CI fails due to security, bump package with CVE

[kevinferrare]

No description provided.

[Copilot]

Pull request overview

This PR pins Microsoft.OpenApi to version 2.7.5 via central package management (likely to address a security scanner/CVE finding) and adds several long-form planning/review documents related to speculative CFG exploration and a future value-prediction/static-analysis layer over CfgCpu.

Changes:

• Add a centrally managed version for Microsoft.OpenApi (2.7.5) in both src/ and tests/ package version files (with transitive pinning enabled).
• Add a design/constraints plan for a reusable static-analysis/value-prediction layer.
• Add documentation capturing a gradual plan to enable speculative CFG exploration by default in tests, plus an archived review write-up of the speculative execution feature.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
VALUE_PREDICTION_ANALYSIS_LAYER_PLAN.md	New design document for a future analysis/value-prediction layer over the CFG AST.
SPECULATIVE_CFG_ENABLEMENT_PLAN.md	New plan document for gradually enabling speculative CFG exploration in tests and managing golden regen impact.
.ai/review/pr-review-feature-speculative_execution.md	New archived review document capturing prior findings and risks for speculative discovery.
tests/Directory.Packages.props	Pins Microsoft.OpenApi to 2.7.5 for test restore graph (central + transitive pinning enabled).
src/Directory.Packages.props	Pins Microsoft.OpenApi to 2.7.5 for product restore graph (central + transitive pinning enabled).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.