Use the AES factory for closed CBC provider locals

Replace a closed parameterless AesCryptoServiceProvider plain local with Aes.Create(), consistently retyping the local and resolved forwarded properties/transforms. Preserve key/IV/padding/size expressions, order and lifetime. Allow Mode only as a resolved literal CBC assignment; reject FeedbackSize, mode observations/other assignments, identity, escapes, captures, explicit disposal, using resources, initializers, directives and conditional snapshots. Standalone modern-.NET cleanup; no historical Framework CSP/FIPS or format change.