Bump dotnet-runtime/dotnet-aspnetcore/dotnet-sdk to 10.0.11/10.0.400 (fixes cgroup v2 root-cgroup segfault)

[rkoster]

Summary

Bumps dotnet-runtime and dotnet-aspnetcore from 10.0.2 to 10.0.11, and dotnet-sdk from 10.0.300 to 10.0.400, by merging in three already-mirrored, not-yet-merged dependency-bot branches:

• pr-by-releng-bot-1786473315 (dotnet-runtime 10.0.11)
• pr-by-releng-bot-1786473390 (dotnet-aspnetcore 10.0.11)
• pr-by-releng-bot-1786473529 (dotnet-sdk 10.0.400)

Why this matters

.NET 10.0.2 (currently vendored on master) is exposed to a segfault crash bug in coreclr's cgroup v2 memory-limit extraction:

• Bug: dotnet/runtime#130092 — a regression introduced in .NET 9.0 (dotnet/runtime#93611, hierarchical memory limits support). When a process's cgroup path is the root of the cgroup v2 mount (no per-container subdirectory), the hierarchical memory-limit walk-up loop reads past the mount root, causing an access violation crash during app startup. This is distinct from — and more severe than — the heap-hard-limit-not-enforced issue fixed in Export DOTNET_GCHeapHardLimit from MEMORY_LIMIT to fix cgroup v2 memory handling #1317; it's an outright segfault, independent of any DOTNET_GCHeapHardLimit/DOTNET_GCHeapHardLimitPercent configuration, since it happens during early CLR/GC initialization before those settings are consulted.
• Fix: dotnet/runtime#130377 (mainline), backported to release/10.0 via dotnet/runtime#130404 — merged Jul 9, 2026, milestone 10.0.11, Servicing-approved.
• Shipped: .NET 10.0.11 released 2026-08-11 (confirmed via the official dotnet/core release manifest: "latest-release": "10.0.11").

This bump pulls in the actual upstream fix rather than relying on any workaround.

Verification

• Confirmed all three buildpacks.cloudfoundry.org artifact URLs return HTTP 200.
• Independently downloaded each artifact and verified its SHA256 matches the sha256 field in the merged manifest entries (dotnet-runtime, dotnet-aspnetcore 10.0.11; dotnet-sdk 10.0.400) — all three match.
• go build -mod=vendor ./src/dotnetcore/... clean.
• Unit tests (finalize, hooks, project, supply — same scope as scripts/unit.sh) all passing.
• VERSION file correctly unaffected by the merges (dependency-bot branches were based on a slightly stale master snapshot for VERSION, but 3-way merge correctly preserved the current 2.4.52).
• Full integration suite (not run in this environment).

[rkoster]

Folding this into #1318 instead — since #1318 already needed a dotnet-runtime/aspnetcore bump to make .NET 10 usable at all (10.0.2 → 10.0.10), and this segfault fix is really "that same bump, taken one step further for correctness" (10.0.10 → 10.0.11), it makes more sense for both to land together so anyone merging #1318 gets a genuinely working, crash-free .NET 10 experience rather than needing to track down and combine two separate PRs. Verified live on a real CF foundation with the combined state (see #1318 for details) — staging and startup both succeeded with dotnet-sdk 10.0.400 / dotnet-runtime+aspnetcore 10.0.11. Closing in favor of #1318.