fix: fix Windows CI build failures

[BeiBaiNian]

Why

The Windows CI builds on this repo are broken in two places:

1. Python Bindings Test (python_binding.yml, build (windows-latest, 3.12)): fails at the "Build and install" step with

   CMake Error at .../_deps/json-src/CMakeLists.txt:1 (cmake_minimum_required):
     Compatibility with CMake < 3.5 has been removed from CMake.
   

   The Windows runner ships CMake 4.x, which removed compatibility with cmake_minimum_required(VERSION < 3.5). The pinned nlohmann/json v3.11.2 declares cmake_minimum_required(VERSION 3.1), so CMake 4.x rejects it while configuring the FetchContent dependency. Ubuntu is unaffected because its CMake is still 3.x.

2. CI (ci.yml, Windows Latest (MSVC 19.29)): fails at the "Configuring CMake files" step with

   CMake Error at CMakeLists.txt:29 (project):
     Running 'nmake' '-?' failed with: The system cannot find the file specified
   CMake Error: CMAKE_CXX_COMPILER not set, after EnableLanguage
   

   The windows-latest runner has Visual Studio installed, but the MSVC compiler (cl.exe) and nmake are not on the PATH until the MSVC developer environment is activated. The job ran cmake .. without activating it.

What changed

• setup.py: add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to the CMake arguments. It is the official escape hatch suggested by the CMake 4.x error message, allowing the old cmake_minimum_required(VERSION 3.1) declaration of nlohmann/json v3.11.2 to be accepted. The json version is left untouched, so the pybind11 v2.11.1 compatibility is preserved.
• .github/workflows/ci.yml: add a "Set up MSVC environment" step using ilammy/msvc-dev-cmd@v1 right after the CMake setup in the Windows job, so CMake can find nmake and the MSVC compiler. The action is MIT-licensed, widely used, and already approved in the Apache org action allowlist.

Verification

• Both fixes were verified on the fork (BeiBaiNian/casbin-cpp): Python Bindings Test (ubuntu + windows) turns green, and the CI Windows job configures CMake successfully.
• No third-party action outside the Apache allowlist is introduced.