….15.3 (#3488)

## Why make this change?

Bump `OpenTelemetry.Exporter.OpenTelemetryProtocol` to pick up patch
fixes from 1.15.3.

## What is this change?

- Updated `OpenTelemetry.Exporter.OpenTelemetryProtocol` from `1.13.0` →
`1.15.3` in `src/Directory.Packages.props` (centrally managed versions)

## How was this tested?

- [ ] Integration Tests
- [ ] Unit Tests

## Sample Request(s)

N/A — dependency version bump only.

> [!WARNING]
>
> <details>
> <summary>Firewall rules blocked me from connecting to one or more
addresses (expand for details)</summary>
>
> #### I tried to connect to the following addresses, but was blocked by
firewall rules:
>
> - `www.nuget.org`
> - Triggering command:
`/home/REDACTED/work/_temp/ghcca-node/node/bin/node
/home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps
/home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js`
(dns block)
>
> If you need me to access, download, or install something from one of
these locations, you can either:
>
> - Configure [Actions setup
steps](https://gh.io/copilot/actions-setup-steps) to set up my
environment, which run before the firewall is enabled
> - Add the appropriate URLs or hosts to the custom allowlist in this
repository's [Copilot coding agent
settings](https://github.com/Azure/data-api-builder/settings/copilot/coding_agent)
(admins only)
>
> </details>

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: RubenCerna2079 <[email protected]>
Co-authored-by: Ruben Cerna <[email protected]>

….15.3 (#3488)

## Why make this change?

Bump `OpenTelemetry.Exporter.OpenTelemetryProtocol` to pick up patch
fixes from 1.15.3.

## What is this change?

- Updated `OpenTelemetry.Exporter.OpenTelemetryProtocol` from `1.13.0` →
`1.15.3` in `src/Directory.Packages.props` (centrally managed versions)

## How was this tested?

- [ ] Integration Tests
- [ ] Unit Tests

## Sample Request(s)

N/A — dependency version bump only.

> [!WARNING]
>
> <details>
> <summary>Firewall rules blocked me from connecting to one or more
addresses (expand for details)</summary>
>
> #### I tried to connect to the following addresses, but was blocked by
firewall rules:
>
> - `www.nuget.org`
> - Triggering command:
`/home/REDACTED/work/_temp/ghcca-node/node/bin/node
/home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps
/home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js`
(dns block)
>
> If you need me to access, download, or install something from one of
these locations, you can either:
>
> - Configure [Actions setup
steps](https://gh.io/copilot/actions-setup-steps) to set up my
environment, which run before the firewall is enabled
> - Add the appropriate URLs or hosts to the custom allowlist in this
repository's [Copilot coding agent
settings](https://github.com/Azure/data-api-builder/settings/copilot/coding_agent)
(admins only)
>
> </details>

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: RubenCerna2079 <[email protected]>
Co-authored-by: Ruben Cerna <[email protected]>

#3512)

## Why make this change?

This backport ports a set of MCP-related and schema-related bug fixes
from `main` to `release/2.0` so the 2.0 release line includes:

- Correct MCP `initialize` `instructions` field on the HTTP/SSE
transport (was missing despite `runtime.mcp.description` being
configured).
- Schema validation of `runtime.mcp.description` (was supported in code
but missing from `dab.draft.schema.json`, causing valid configs to fail
validation).
- Schema default for `runtime.host.authentication.provider` aligned with
the documented/CLI default of `Unauthenticated` (was incorrectly
`AppService`).
- MCP `logging/setLevel` JSON-RPC method support, dynamic log-level
updates, and clean stdout for MCP stdio mode.
- Consistent CLI log labels matching ASP.NET Core's default console
formatter (prerequisite for the MCP log-level work).

## What is this change?

Cherry-picked PRs (chronological order on `main`):

1. Make CLI Log Labels consistent with ASP.NET Core and use appropriate
label on startup
[#3307](#3307) — included
as a prerequisite for #3419 (introduces the shared abbreviated-label
dictionary).
2. Added server description to dab.draft.schema
[#3405](#3405)
3. Changed default authentication provider to "Unauthenticated" in
`dab.draft.schema.json`
[#3424](#3424)
4. Added changes to set `McpServerOptions.Instructions` in HTTPS/SSE
mode [#3423](#3423)
5. Implemented MCP Set Log Level
[#3419](#3419)
6. Upgrade `OpenTelemetry.Exporter.OpenTelemetryProtocol` from 1.13.0 to
1.15.3 [#3488](#3488) —
required to unblock CI on `release/2.0` (fixes CVE-2026-42191 /
GHSA-4625-4j76-fww9, which `dotnet format --verify-no-changes` promotes
to an error via `NU1902`).

## How was this tested?

1. Existing and newly added unit/integration tests from each source PR
(e.g., `DynamicLogLevelProviderTests`,
`TestMcpInitializeIncludesInstructionsFromRuntimeDescription`,
`CustomLoggerTests`, `McpRuntimeOptionsSerializationTests`).
2. `dotnet build` of `src/Cli`, `src/Service`, and `src/Cli.Tests` on
the cherry-pick branch — succeeded with 0 warnings, 0 errors.
3. Manual verification on `main` was performed in each original PR; no
additional manual verification was added for the backport.

## Sample Request(s)

N/A — these are bug fixes; no new public API.

---------

Co-authored-by: Souvik Ghosh <[email protected]>
Co-authored-by: aaronburtle <[email protected]>
Co-authored-by: RubenCerna2079 <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Ruben Cerna <[email protected]>