Release v22.126.0

Protected decision commands can now run validators that take dependencies, provided the application builds its service provider through Arc's new protected-decision provider factory.

Added

• ProtectedDecisionServiceProviderFactory and BuildProtectedDecisionServiceProvider() build a Microsoft DI provider that Arc can certify. In a [ProtectedDecision] command running in a scope of that provider, discoverable validators whose constructors take DecisionRead<T>, the command-aware IDecisionReads, or freshly constructed transient collaborators are constructed per invocation and run. Previously these validators were refused. See https://github.com/Cratis/Arc/blob/main/Documentation/backend/csharp/chronicle/consistency/certified-validators.md. (#2831)
• AddProtectedDecisionValidator<TValidator>(configure) registers a validator whose extra rules, added in configure, apply to that fresh instance. Use it instead of a factory or instance registration, which protected decisions still refuse. (#2831)

Changed

• The new capability refuses anything it cannot certify: cloned, wrapped or root providers, disposed scopes, application-registered readers or validator factories, collections of readers or read tokens, and dependency graphs with cached or opaque services. It runs on JIT only and is refused where dynamic code is unavailable. Parameterless validators, commands with read protection switched on and unprotected commands behave as before. (#2831)