AspNetCore: Add DataContractSerializer options for configurable reader quotas

[Copilot]

Exposes per-format serializer options so hosts can restrict XML reader quotas to mitigate denial-of-service (DoS) risks. By default all quotas remain at Max (current behavior unchanged).

New public API

Options classes (Serialization/DataContractSerializerOptions.cs):

• DataContractSerializerOptions — base class with ReaderQuotas (XmlDictionaryReaderQuotas, mutable, defaults to max values)
• BinaryDataContractSerializerOptions : DataContractSerializerOptions
• XmlDataContractSerializerOptions : DataContractSerializerOptions

Builder methods (OpenRiaServicesOptionsBuilder):

• AddXmlSerialization(Action<XmlDataContractSerializerOptions>? configure, bool defaultProvider = false) — new overload; existing AddXmlSerialization(bool) delegates to it
• ConfigureBinarySerialization(Action<BinaryDataContractSerializerOptions> configure) — replaces the default binary provider in-place, preserving shared DataContractCache

builder.Services.AddOpenRiaServices()
    .ConfigureBinarySerialization(o =>
    {
        o.ReaderQuotas = new XmlDictionaryReaderQuotas { MaxStringContentLength = 1 * 1024 * 1024 };
    })
    .AddXmlSerialization(o =>
    {
        o.ReaderQuotas = new XmlDictionaryReaderQuotas { MaxStringContentLength = 1 * 1024 * 1024 };
    });

Internal wiring

• BinaryMessageReader.Rent() accepts XmlDictionaryReaderQuotas and applies them on every call (thread-static cache remains safe — SetInput reinitializes with the provided quotas each time)
• DataContractRequestSerializer stores _readerQuotas from its provider's options and passes them through to BinaryMessageReader.Rent()
• BinaryXmlSerializationProvider / TextXmlSerializationProvider each hold their own options instance and pass it to every created serializer
• DataContractSerializationProvider.CopyDataContractCacheFrom() replaces direct internal-field access for cache sharing

[sonarqubecloud]

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud