Harden log4net against the findings of a security audit

[FreeAndNil]

Appenders: network and transport

• 2fb4539 time out writes to stalled TelnetAppender clients
• 15d16ee add a listen address to TelnetAppender
• bd35fe0 add a TransportSecurity option to the MailKit SmtpAppender

Appenders: syslog record integrity

• eccb876 escape NUL characters in LocalSyslogAppender messages
• 46582e5 report a RemoteSyslogAppender Identity that would split the record
• 360a102 fix the lifetime of the LocalSyslogAppender identity

AdoNet appender

• 9f5c955 contain per-event failures in AdoNetAppender.SendBuffer
• 19fdb4a warn when AdoNetAppender executes layout-generated SQL
• e80b381 redact the password when reporting a failed database connection

Reliability and resource bounds

• 3fd97cb bound the waits for the file locking mutexes
• 394fd3d bound regular expression matching in the string match filters
• 86ecb15 flush TextWriterAppender under the appender lock
• 1786b13 keep the impersonated user name when a logging event is fixed

Diagnostics

• ecd1b8b report the first appender error without log4net.Internal.Debug

Build and release infrastructure

• 9cc34d2 make the release verification scripts fail closed
• 28d411a pin the Maven wrapper and distribution downloads
• e203b7c remove the git-broadcast workflow

Documentation

• 6bc3df3 document that configuration is trusted input
• 287fa9c document that format strings are trusted developer input
• dc17e1b document the conventions the security scan work relied on (Harden log4net against the findings of a security audit #309)

Notes for reviewers

Several commits introduce secure defaults with a named opt-out (SendTimeoutMillis, MatchTimeoutMillis, LockTimeoutMillis); those are behaviour changes on upgrade and are recorded in the changelog. The documentation commits deliberately settle recurring reports in the threat model rather than changing code.