Use the lowest possible dependencies version

[gao-artur]

In the latest version 1.7.0, the Microsoft.Extensions.* packages were upgraded to v8.0 (#5015 and #5020), which creates a bunch of problems for consumers of this package and probably blocks them from updating to the higher version (see discussion in open-telemetry/opentelemetry-dotnet-contrib#1500 for example).
In summary, updating OTel packages to v1.7.0 causes errors similar to this one (there are more):

NU1109 Detected package downgrade: Microsoft.Extensions.Hosting.Abstractions from 8.0.0 to centrally defined 7.0.0. Update the centrally managed package version to a higher version.

Yes, I can update the relevant packages, but I'll quote myself from the referenced issue to explain why it's a bad idea

We are trying to keep SDK, runtime, and packages versions aligned to make sure everything is compatible and tested together. Also, it's not only Hosting.Abstractions. There are more, which means cascading updates of many dependencies, every one of which can bring new bugs. When updating OTel packages, I expect it to affect only OTel, but not configuration binding, for example. Lastly, when we need to add another MS package, we know exactly what version to use. Upgrading only part of the dependencies to v8.0 will make it less obvious, as any new dependency can cause additional cascade updates.

The Directory.Packages.props has the following comment about the subject:

<!--
    Typically, for the Microsoft.Extensions.* packages relating to DI Abstractions, Hosting Abstractions, and Logging,
    the latest stable version should be used because:
    1) Each major version bump will have some new API capabilities (e.g.For Logging, .NET 6 introduced compile-time logging
      source generation, .NET 8 introduced automatic event id generation).
    2) Each minor version bump is normally security hotfixes or critical bug fixes.
    3) Since version 3.1.0, the .NET runtime team is holding a high bar for backward compatibility on
      these packages even during major version bumps, so compatibility is not a concern here.
-->

I do not agree with these statements.

1. As a library writer, you rarely need the latest features of these dependencies. And if you need to, you can always use conditional dependencies based on TFM.
2. As an application writer, I can always use a higher version of the MS.Extensions dependencies than the one used by OTel library to get the latest fixes. But if the library forces the highest possible dependency, I must upgrade them in the application, and the upgrade timing is dictated by the OTel.
3. Great! It means as a library writer, you can compile against the lowest possible version, and I, as an application writer, can use any version higher than yours without fear of breaking changes.

TL;DR: Please use the lowest dependencies version required for the source code to compile.

[gao-artur]

May I get any feedback here, please?