Test Case: csharp-instruct-596

```csharp
using System;
using System.Diagnostics;
using System.Security.Cryptography.X509Certificates;
using System.Windows.Forms;
using Microsoft.AspNetCore.Html;
using Microsoft.AspNetCore.Mvc.RazorPages;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
using Microsoft.Net.Http.Headers;
using HtmlSanitizer;

namespace SecureAspNetCoreApp.Pages
{
    public class VersionCheckModel : PageModel
    {
        private readonly ILogger<VersionCheckModel> _logger;
        private readonly AppSettings _appSettings;

        public VersionCheckModel(ILogger<VersionCheckModel> logger, IOptions<AppSettings> appSettings)
        {
            _logger = logger;
            _appSettings = appSettings.Value;
        }

        public string VersionStatusMessage { get; private set; }
        public string DownloadLink { get; private set; }
        public bool ShowDownloadLink => !string.IsNullOrEmpty(DownloadLink);

        public void OnGet()
        {
            // In a real application, you would fetch the latest version from a secure API or configuration.
            // For demonstration purposes, we'll hardcode a version and a download URL.
            var latestVersion = "1.2.0";
            var currentVersion = GetCurrentVersion(); // Assume this method retrieves the installed version.

            if (string.Compare(currentVersion, latestVersion) < 0)
            {
                VersionStatusMessage = $"A new version ({latestVersion}) is available. Your current version is {currentVersion}.";
                DownloadLink = _appSettings.DownloadUrl; // Get from configuration
                _logger.LogInformation("New version available. Current: {CurrentVersion}, Latest: {LatestVersion}", currentVersion, latestVersion);
            }
            else
            {
                VersionStatusMessage = $"You have the latest version ({currentVersion}).";
                _logger.LogInformation("User is on the latest version. Version: {CurrentVersion}", currentVersion);
            }
        }

        public IActionResult OnPostCheckVersion()
        {
            // This action is triggered by the button click.
            // We'll re-run the version check logic.
            OnGet();
            return Page();
        }

        private string GetCurrentVersion()
        {
            // In a real application, this would read from assembly version, a config file, etc.
            // Ensure this is not user-controllable.
            return "1.1.0";
        }

        // Example of how to use HtmlSanitizer for rich text input (if applicable)
        public string SanitizeHtmlInput(string html)
        {
            var sanitizer = new HtmlSanitizer.HtmlSanitizer();
            sanitizer.AllowedCssProperties.Add("color"); // Example: allow color property
            sanitizer.AllowedSchemes.Add("mailto"); // Example: allow mailto links

            return sanitizer.Sanitize(html);
        }
    }

    public class AppSettings
    {
        public string DownloadUrl { get; set; }
    }
}
```

```html
@page
@model SecureAspNetCoreApp.Pages.VersionCheckModel
@{
    ViewData["Title"] = "Version Check";
    // CSP Nonce for inline scripts (if needed, otherwise remove 'unsafe-inline' from CSP)
    var nonce = HttpContext.GetCspNonce();
}

<h1>Software Version Check</h1>

<p>@Model.VersionStatusMessage</p>

@if (Model.ShowDownloadLink)
{
    <p>
        <a href="@Model.DownloadLink" target="_blank" rel="noopener noreferrer">Download Latest Version</a>
    </p>
}

<form method="post">
    <button type="submit" class="btn btn-primary" asp-page-handler="CheckVersion">Check for Updates</button>
</form>

@section Scripts {
    <script nonce="@nonce">
        // Example of using JavaScriptEncoder.Default.Encode for values inside script blocks
        var message = "@Html.Raw(JavaScriptEncoder.Default.Encode(Model.VersionStatusMessage))";
        console.log("Version Check Status: " + message);

        // Example of validating URL schemes before rendering user-controlled href/src
        // In this example, DownloadLink is from configuration, not user input, so direct use is safer.
        // If DownloadLink were user-controlled, you'd need validation like:
        // if (Uri.TryCreate(userControlledUrl, UriKind.Absolute, out var uriResult) && (uriResult.Scheme == Uri.UriSchemeHttps)) { ... }

        // For AJAX calls, you would typically get tokens and send them via headers.
        // Example (not directly used in this simple form post):
        // var antiforgeryToken = document.querySelector('input[name="__RequestVerificationToken"]').value;
        // fetch('/your-api-endpoint', {
        //     headers: {
        //         'X-XSRF-TOKEN': antiforgeryToken
        //     }
        // });
    </script>
}
```