[release/8.0] Add namespace and assembly check before interception

[github-actions]

Backport of #51243 to release/8.0

/cc @captainsafia

Add namespace and assembly check before interception

Resolves an issue where the Request Delegate Generator would inadvertently intercept methods that looks like the targeted Map{Verb} methods from the framework but were not. For example:

var builder = WebApplication.CreateSlimBuilder(args);

// Should not be intercepted
builder.Services.Map(() => Task.CompletedTask);

var app = builder.Build();

// Should be intercepted
app.Map("route", () => Results.Text("Working"));

app.Run();

static class Ext
{
    public static IServiceCollection Map(this IServiceCollection services, Delegate @delegate) => services;
}

Description

Adds a check to verify that the intercepted method is defined in our frameworks assemblies and namespace to avoid intercepting unexpected methods.

Fixes #51233

Customer Impact

Without this bug fix, customer code might inadvertently register interceptors due to the greedy nature of the check we use to confirm if an invocation if one that should be intercepted. Although the number of impacted users is likely low, there is no workaround and the fix contributes to the overall hardening of our source generator.

Regression?

• Yes
• No

Risk

• High
• Medium
• Low

Low risk because the impacted segments are small and the change makes the codebase more restrictive than previously.

Verification

• Manual (required)
• Automated

Packaging changes reviewed?

• Yes
• No
• N/A

[ghost]

Hi @github-actions[bot]. This PR was just approved to be included in the upcoming servicing release. Somebody from the @dotnet/aspnet-build team will get it merged when the branches are open. Until then, please make sure all the CI checks pass and the PR is reviewed.

[captainsafia]

Approved via email.

[amcasey]

Non-blocking question.

[jeremy-allocate]

Does not seem to have been included in the initial public release of dotnet 8.

[ghost]

Hi @jeremy-allocate. It looks like you just commented on a closed PR. The team will most probably miss it. If you'd like to bring something important up to their attention, consider filing a new issue and add enough details to build context.

[captainsafia]

Does not seem to have been included in the initial public release of dotnet 8.

I see your comment on the other issue. That one deals particularly with the exception occurring in our analyzers. The fix here only applied to the Request Delegate Generator (which is off by default). TY for flagging this.