chore(deps): upgrade OData libraries to 9.0 (blocked on Microsoft.AspNetCore.OData 10) #594

Part 8 of the outdated-package sweep (dotnet-outdated 4.8.1, 2026-11-05). Blocked / tracking issue for the OData .NET 9 major upgrade. Do not start implementation until the blocker clears.

Current state

• Root Directory.Packages.props: <ODataVersion> 8.4.3 (Microsoft.OData.Core), Microsoft.Spatial 8.4.3 (pinned separately); Microsoft.OData.Edm is transitive. Microsoft.AspNetCore.OData 9.4.1 (-> 9.5.0 via the minor-update issue).
• Samples datasync-server and datasync-server-cosmosdb-singlecontainer pin Microsoft.OData.Core and Microsoft.OData.Edm 8.4.3 explicitly.
• Latest: Microsoft.OData.Core/Edm/Spatial 9.0.0 GA (targets .NET 10; Edm.Date/Edm.TimeOfDay map to DateOnly/TimeOnly; merged async message interfaces; other API changes). Release notes: https://github.com/OData/odata.net/releases/tag/9.0.0

Blocker

Microsoft.AspNetCore.OData 9.x declares dependencies Microsoft.OData.Core/Edm/Spatial [8.4.0, 9.0.0). A move to ODL 9.0.0 requires a Microsoft.AspNetCore.OData release that supports it (10.0.0, currently preview only; see https://github.com/OData/AspNetCoreOData/releases). Because CentralPackageTransitivePinningEnabled is on, forcing 9.0.0 would produce NU1608/NU1109 conflicts or runtime breakage.

The tool's "Major" flag for these three packages is therefore not actionable today; the patch bump to 8.4.4 is handled in the "bump .NET, EF Core and library patch versions" issue.

When unblocked (Microsoft.AspNetCore.OData 10.x stable)

1. Bump Microsoft.AspNetCore.OData, <ODataVersion>, and Microsoft.Spatial together; update the two sample csproj pins.
2. Review code in src/CommunityToolkit.Datasync.Server that uses Microsoft.OData.* / OData query options for API changes (DateOnly/TimeOnly mapping, URI/query parsing); check the Server and Abstractions tests and the DTO date handling.
3. dotnet build && dotnet test; dispatch build-library.yml and build-samples.yml.
4. Document any breaking change for consumers in the docs (docs/in-depth/server).

Revisit this issue when Microsoft.AspNetCore.OData 10.x reaches GA.