Add MA0224 and MA0225 to require the Respect* options on JsonSerializerOptions

[meziantou]

What

Two new rules, disabled by default, that extend MA0222/MA0223 to the options built at runtime:

• MA0224 — JsonSerializerOptions should set RespectNullableAnnotations
• MA0225 — JsonSerializerOptions should set RespectRequiredConstructorParameters

Why

MA0222 and MA0223 only look at the [JsonSourceGenerationOptions] attribute of a JsonSerializerContext. An application that serializes with new JsonSerializerOptions() gets the same silent legacy behavior — null read into a non-nullable member, and missing constructor parameters filled with their default value — with nothing reporting it. Like MA0222 and MA0223, the rules do not require a particular value: setting the option to false is a deliberate choice and satisfies them.

How

JsonSerializerOptionsAnalyzer registers an operation action on OperationKind.ObjectCreation and considers the option configured when:

• it is set in the object initializer, or
• it is set on the local the creation is assigned to (var o = new JsonSerializerOptions(); o.RespectNullableAnnotations = true;), including a local assigned after its declaration, and

Not reported:

• new JsonSerializerOptions(other) — the copy constructor starts from an instance configured elsewhere
• new JsonSerializerOptions(JsonSerializerDefaults.Strict) — sets both options (.NET 10)
• anything, when the target framework predates the properties (.NET 9), same gate as MA0222/MA0223

new JsonSerializerOptions(JsonSerializerDefaults.Web) and General are reported.

JsonSerializerOptionsFixer adds <Option> = true to the object initializer, creating the initializer when the creation has none.

Notes for the reviewer

• The diagnostic is reported on the creation without its object initializer, so a long { ... } block is not squiggled: new JsonSerializerOptions, new(), new JsonSerializerOptions(...).
• Documented limitations: options configured without a new (ConfigureHttpJsonOptions, AddJsonOptions in ASP.NET Core), and a local configured from another method, are not detected. A rule for the configure-lambda case could be a follow-up.

Validation

• New tests: 22, passing on all five Roslyn versions (4.8, 4.14, 5.0, 5.6, 5.9)
• Full Meziantou.Analyzer.Test.roslyn5.9 suite: 4070/4070 passing
• dotnet run --project src/DocumentationGenerator run until it reported no change