fix(csharp-ci): match CodeCoverage 18.9.0 relocated cobertura output

[monsieurleberre]

Pre-open

• pre-open review completed — findings addressed locally or explicitly deferred below

Summary

Consumers that bump Microsoft.Testing.Extensions.CodeCoverage to 18.9.0 hit a hard failure in the Merge per-project cobertura reports step: on .NET SDK 10.0.3xx, solution-level dotnet test resolves the relative --coverage-output against the run-level <working-directory>/TestResults/ instead of each project's bin/Release/<tfm>/TestResults/, so the default tests-glob matches nothing. The relocation needs the combination — 18.8.0 + SDK 10.0.301 and 18.9.0 + SDK 10.0.1xx both keep the per-project layout.

First hit and diagnosed in peacefulstudio/daml-codegen-csharp-internal (run 28971047292); the equivalent caller-side override was validated green in daml-codegen-csharp-internal#585 (merge step matched all 10 files at the relocated path).

Changes

• Broaden the default tests-glob to 'tests/**/bin/Release/net*/**/*.cobertura.xml TestResults/**/*.cobertura.xml' — the merge step intentionally word-splits the input under globstar nullglob, so multiple globs are supported; the second glob is recursive to also cover potential run-subdirectory nesting (** matches zero segments, verified).
• Update the input description and the README Caller prerequisites section: document both output layouts and the toolchain combination that selects them.
• Reconcile the stale README pinning note ("do not bump CodeCoverage past 18.0.x") — its condition was met when xunit.v3.mtp-v2 shipped; 18.x through 18.9.x is supported, the 19.x empty-output warning stays.
• Broaden the cobertura filename advice: unique per project and TFM, since the relocated layout shares one TestResults/ directory across all projects.

Compatibility

Purely additive for default consumers (old layout still matched first; new glob expands to nothing under nullglob on old toolchains). Consumers passing an explicit tests-glob are unaffected. Windows shards run the step under shell: bash, so globstar semantics hold.

Testing

• YAML validated (yaml.safe_load).
• Glob semantics verified in bash with globstar nullglob (zero-segment and nested matches).
• End-to-end behavior validated via the identical caller-side override in daml-codegen-csharp-internal#585 (CI green, 10 files merged from TestResults/).