Add DevSecOps-10309 demo page with intentional vulnerabilities for GHAS scanning

[Copilot]

New demo page showcasing GitHub Advanced Security capabilities through intentional security vulnerabilities and 2026 GHAS feature updates.

New Files

• DevSecOps-10309.cshtml - Razor page with GHAS news, interactive vulnerability demos (ReDoS, SQL injection testing)
• DevSecOps-10309.cshtml.cs - Code-behind with ILogger and intentional security flaws

Intentional Vulnerabilities

Implements patterns that GHAS code scanning should detect:

// Log forging - unsanitized user input
_logger.LogInformation($"User accessed page: {userInput}");

// ReDoS - nested quantifiers
private static readonly Regex VulnerableRegex = new Regex(@"^(a+)+$");

// SQL injection - string concatenation
string query = "SELECT * FROM Users WHERE UserId = " + userId;

// Hardcoded credentials
private const string CONNECTION_STRING = "Server=prod-sql;User Id=sa;Password=P@ssw0rd123!;";

// Insecure deserialization
JsonConvert.DeserializeObject<List<string>>(jsonData, new JsonSerializerSettings {
    TypeNameHandling = TypeNameHandling.Auto
});

Package Changes

Downgraded to vulnerable versions for demonstration:

• Newtonsoft.Json: 13.0.1 → 12.0.2 (GHSA-5crp-9r3c-p9vr)
• System.Text.Json: 8.0.4 (GHSA-8g4q-xg66-9fp4)
• Microsoft.Data.SqlClient: 5.0.2 (GHSA-98g6-xh36-x2p7)

UI Updates

Added navigation link in Index.cshtml to new demo page.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>feat: DevSecOps (04)</issue_title>
<issue_description>- Use the gh-advsec-devsecops repository from the workspace

• Create me a new unique branch name under feature/devsecops-demo-[randon-number]
• Create a new DevSecOps-[random-number].cshtml page and reference it into the Index page.
• Add some content to it with some latest news about GitHub Advanced Security.
• Implemented the ILogger for the backend code of the page.
• For demo purpose, generate some C# insecure code, like log forging or regex exposure
• Add package System.Text.Json --version 8.0.4
• Add package Microsoft.Data.SqlClient --version 5.0.2
• Add package newtonsoft.json --version 12.0.2
• Build the webapp to make sure there are not build errors.
• Prepare for committing the changes.</issue_description>

<agent_instructions>implement this</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes feat: DevSecOps (04) #122

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.