Add lightweight API security sample

[balajibashyam]

Summary

Adds a minimal .NET 10 companion sample for the ASP.NET Core 8 API Security: JWT Authentication, CSRF Protection & Rate Limiting tutorial.

What's included

• New sample: aspnet-core/api-security-in-practice/ — 10 files

  • Minimal API with JWT bearer authentication and short-lived tokens
  • POST /auth/token login endpoint (development-only, one seeded demo user)
  • Protected Notes API with ownership enforcement (404 for another user's note)
  • Login rate limiting (5/min) and per-user API rate limiting (20/min)
  • RFC-style 401 and 429 application/problem+json responses
  • 6 integration tests via WebApplicationFactory
  • No database, cookies, CSRF, CORS, or external services

• Root README: New sample row in the table + updated repository structure

• GitHub Actions: New test-api-security job with JWT key env var; path filters updated

Deliberately omitted (stays in the full tutorial)

Cookie authentication, mixed JWT/cookie schemes, CSRF tokens, CORS, HSTS, CSP, ASP.NET Core Identity, BCrypt password hashing, refresh tokens, token revocation, authorization handlers, admin dashboards, browser JavaScript, attack-lab vulnerabilities, OAuth 2.0/OpenID Connect, deployment guidance, production secret stores.

Versions

• .NET SDK: 10.0.302
• Microsoft.AspNetCore.Authentication.JwtBearer: 10.0.10
• Microsoft.AspNetCore.Mvc.Testing: 10.0.10

Validation

• dotnet restore — passed
• dotnet build --configuration Release — passed (0 errors)
• dotnet test --configuration Release — passed (6/6)
• Security scan — clean (no signing keys, no committed tokens)