build: raise the analyzer rules to error and fix the reported code

[glennawatson]

What kind of change does this PR introduce?

build

What is the new behavior?

Every StyleSharp, PerformanceSharp, SecuritySharp and public API rule is an error, and the code they reported is fixed.

• The rules that were previously off, advisory or warning-level are now errors. Nothing is left at suggestion or warning, so the build fails on any of them rather than accumulating advisories.
• Each rule still disabled carries the conflict that keeps it off, beside the rule, so the next person does not have to rediscover it:
  • SST1118 cannot hold with stylesharp.max_line_length = 200 - 18 of its 41 sites do not fit on one line, the longest reaching 429 characters.
  • SST1417 derives the expected namespace from the folder, so a type that deliberately lives in a BCL namespace has no satisfying layout.
  • SST1533 reports a file that declares no type, which is what an #if-guarded polyfill looks like on frameworks that already have the API.
  • SST1416 demotes a public member of a non-public type to internal. That is not safe here: Type.GetProperty and Activator.CreateInstance(Type) use binding flags that see public members only, so the demotion compiles and then changes behaviour.
  • SST1609 requires a <value> element that only ever restates the <summary>.
• stylesharp.use_var is set to always, so the var-versus-explicit rule follows the csharp_style_var_* preferences already in the file instead of its own default.
• The test, benchmark and example trees relax the rules that do not apply to a harness, in the per-folder .editorconfig each tree already has - debugger-display and inlining attributes on test types, and identical benchmark bodies, which are the design of a [GlobalSetup(Target = ...)] benchmark rather than a copy that was meant to differ.
• RootObject maps to its JSON field names with [JsonPropertyName]. It previously relied on the property identifiers happening to spell _id and _rev, so the contract was invisible to a reader and broke under a rename.
• Every documented exception says when it is thrown. The <exception> elements name the condition that reaches the throw, rather than naming the type and leaving the reader to find the guard.

What is the current behavior?

Most of these rules were disabled, advisory or warning-level, so their findings never failed a build. The two .editorconfig files that relax rules for the test and benchmark trees did not cover the rules newly raised here, and a documented exception named only its type.

What might this PR break?

• Consumers: nothing. No public API changes shape or behaviour; the baselines are regenerated only for attributes added to already-public types.
• Contributors: a build that previously passed with advisories now fails. Anything landing on top of this needs to satisfy the rules as errors.

Checklist

• I have read the Contribute guide
• Tests have been added or updated (for bug fixes / features)
• Docs have been added or updated (for bug fixes / features)
• Changes target the main branch
• PR title follows Conventional Commits

Additional information

Most of the diff is analyzer fix output and regenerated public API baselines. The hand-written parts worth review are:

• .editorconfig, src/tests/.editorconfig, src/benchmarks/.editorconfig - the severities and the recorded conflicts.
• src/Refit/ApiResponse{T}.cs - the disposal guard is now an interlocked latch.
• src/InterfaceStubGenerator.Shared/Emitter.cs and PooledStringBuilder.cs - the interpolated-string builder drops its _hasContent field and derives the same answer from the buffer length, which needed a new Length member.
• src/InterfaceStubGenerator.Shared/InterfaceStubGeneratorV2.cs - the two candidate-combining methods no longer split their body across #if, and the empty-array guards now apply on both Roslyn versions.
• src/Refit/SystemTextJsonStreamingDeserializer.cs and CamelCaseStringEnumConverter.cs - duplicate bodies now delegate.
• src/tests/Refit.Tests/RootObject.cs - the explicit JSON field mapping.
• Tuple element names on GeneratedRequestRunner.BuildRequestPath and the generator's parse result are PascalCase. These are compile-time names only; generated code builds the tuples positionally.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.91%. Comparing base (873c8bd) to head (bfa2c3d).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2299      +/-   ##
==========================================
- Coverage   99.95%   99.91%   -0.05%     
==========================================
  Files         192      192              
  Lines       10104    10031      -73     
  Branches     1926     1925       -1     
==========================================
- Hits        10099    10022      -77     
- Partials        5        9       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud