Organize and document complex PackageReference options in csproj files

[Copilot]

The PackageReference entries in both csproj files used child-element form (<PrivateAssets> + <IncludeAssets>) without any explanation, and all package references were mixed together in a single ItemGroup, making the intent unclear.

Description

• Library csproj — split the single mixed ItemGroup into two labelled sections:
  • <!-- Build Tool Dependencies --> — Microsoft.Sbom.Targets, Polyfill, Microsoft.SourceLink.GitHub (simple PrivateAssets="All" attribute form)
  • <!-- Code Analysis Dependencies --> — Microsoft.CodeAnalysis.NetAnalyzers and SonarAnalyzer.CSharp with an explanatory comment on why the child-element form is used
• Both csproj files — added XML comments before analyzer packages (Microsoft.CodeAnalysis.NetAnalyzers, SonarAnalyzer.CSharp) explaining:
  • PrivateAssets="all" — keeps these build-time analyzers out of the published package's transitive dependency graph
  • IncludeAssets with explicit asset list — ensures analyzers and buildtransitive asset types are activated so Roslyn analyzers and MSBuild targets run during the build
• Test csproj — added equivalent comment for coverlet.collector, noting that build/buildtransitive assets are required for the data collector MSBuild targets to hook into test runs

<!-- Code Analysis Dependencies -->
<ItemGroup>
  <!-- Analyzer packages use child-element form to configure both PrivateAssets and IncludeAssets:
       - PrivateAssets="all" prevents these build-time analyzers from becoming transitive dependencies
         in packages that consume this library.
       - IncludeAssets lists all asset types (including 'analyzers' and 'buildtransitive') to ensure
         Roslyn analyzers and MSBuild targets are fully activated during the build. -->
  <PackageReference Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="10.0.103">
    <PrivateAssets>all</PrivateAssets>
    <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
  </PackageReference>
</ItemGroup>

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code quality improvement

Pre-Submission Checklist

Before submitting this pull request, ensure you have completed the following:

Build and Test

• Code builds successfully: dotnet build --configuration Release
• All unit tests pass: dotnet test --configuration Release
• Code produces zero warnings

Code Quality

• Code formatting is correct: dotnet format --verify-no-changes
• New code has appropriate XML documentation comments
• Static analyzer warnings have been addressed

Quality Checks

Please run the following checks before submitting:

• Spell checker passes: cspell "**/*.{md,cs}"
• Markdown linter passes: markdownlint "**/*.md"
• YAML linter passes: yamllint .

Testing

• Added unit tests for new functionality
• Updated existing tests if behavior changed
• All tests follow the AAA (Arrange, Act, Assert) pattern
• Test coverage is maintained or improved

Documentation

• Updated README.md (if applicable)
• Updated ARCHITECTURE.md (if applicable)
• Added code examples for new features (if applicable)
• Updated requirements.yaml (if applicable)

Additional Notes

The grouping style for the library csproj now matches the labelled-ItemGroup pattern already used in the test csproj. The three packages using single-line PrivateAssets="All" attribute syntax (Microsoft.Sbom.Targets, Polyfill, Microsoft.SourceLink.GitHub) are self-explanatory and grouped under Build Tool Dependencies.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.