dbup-sqlserver should not take dependency on Microsoft.Azure.Services.AppAuthentication

[Edddy]

IMO the package should only take dependency on System.Data.SqlClient, Sql Azure or any Azure stuff should be in their own package.

[JohnOliver-MyXplor]

This would solve SNYK from reporting a Denial of Service Vulnerability in a project that use dbup-sqlserver.

<PROJECT> > dbup-sqlserver@4.6.0 > Microsoft.Azure.Services.AppAuthentication@1.3.1 > Microsoft.IdentityModel.Clients.ActiveDirectory@4.3.0 > NETStandard.Library@1.6.1 > System.Net.Http@4.3.0

Overview
System.Net.Http is an Provides a programming interface for modern HTTP applications, including HTTP client components that allow applications to consume web services over HTTP and HTTP components that can be used by both clients and servers for parsing HTTP headers.
Affected versions of this package are vulnerable to Denial of Service (DoS) as ASP.NET Core fails to properly validate web requests.
NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

[redoz]

Mend/Whitesource is also flagging this security vulnerability, would be great if the dependency could be updated, or dropped as mentioned.

[mjauernig]

Duplicate of DbUp/dbup-sqlserver#12