Use the AES factory for closed CBC transform scopes

Replace a parameterless inferred AesCryptoServiceProvider using resource with Aes.Create() only when all references are attributed KeySize/BlockSize receivers or two-argument CreateEncryptor/CreateDecryptor receivers. Preserve arguments, order, default CBC policy and disposal, retyping the local and members. Exclude mode/feedback observations, escapes, captures, async/iterators, identity and conditional snapshots. Standalone modern-.NET modernization; no historical Framework CSP/FIPS equivalence assertion.