CI: move vpk and Velopack to 1.2.161, whose Gitea upload survives the forge's new release responses

The desktop nightly has failed on every push to main since 2 October, at 'publish the nightly
release'. vpk 1.2.0 creates the draft release and then reads release.Assets from the forge's
answer, which the upgraded server (28.0.0) no longer fills in for a new release, so it threw a
NullReferenceException at GiteaRepository.cs:136. The step deletes the previous nightly-desktop
release before it uploads, so desktop clients have had no nightly to update from since.

1.2.161 reads the assets null-safely. The library moves with the tool, since Velopack expects the
two to match. Every vpk option the workflow and the release scripts pass is present in 1.2.161;
the only renamed ones are two MSI options nothing here uses.

tests/DodoSSH.Client.App.Tests/packages.lock.json

@@ -480,7 +480,7 @@
           "DodoSSH.Client.Terminal": "[1.0.0, )",
           "DodoSSH.Client.Transfer": "[1.0.0, )",
           "Microsoft.TSS": "[2.1.1, )",
-          "Velopack": "[1.2.0, )"
+          "Velopack": "[1.2.161, )"
         }
       },
       "dodossh.client.api": {
@@ -777,9 +777,9 @@
       },
       "Velopack": {
         "type": "CentralTransitive",
-        "requested": "[1.2.0, )",
-        "resolved": "1.2.0",
-        "contentHash": "Rz67gJL619fSBS6omaSINUxyDuwhIxkm5mmubf7uLd5Qgi6LLKaKCha+QFP6n+Bw/UjA0vutnH4JQfYzn6ANtw=="
+        "requested": "[1.2.161, )",
+        "resolved": "1.2.161",
+        "contentHash": "OpHNacIumnkhaaX3ZlQ/TCR4YPOJvud2/PAOoWb6o+mIrLwIVA275I5wAgt4q/1O2VrJeDwR1qFQyqzG4lUArg=="
       }
     }
   }