[AAP] Collect DataContract JSON response body schemas (#8706)

## Summary of changes

Adds API Security response body schema collection for ASP.NET MVC/Web
API responses serialized with
`DataContractJsonSerializer.WriteObject(response.OutputStream, data)`
([doc](https://learn.microsoft.com/en-us/dotnet/api/system.runtime.serialization.json.datacontractjsonserializer.writeobject?view=netframework-4.8.1)).

This adds a .NET Framework AppSec instrumentation for
`DataContractJsonSerializer.WriteObject(Stream, object)`. The hook only
reports when the serializer writes to the current ASP.NET response
stream, AppSec is enabled, response body parsing is enabled, and an
ASP.NET MVC/Web API scope is active.

It also adds a `DataContractObjectExtractor` for this path. For
`[DataContract]` types, it reports only `[DataMember]` members, uses
`DataMember(Name = ...)`, and skips ignored or unmarked members.

## Reason for change

A case seen writes the response with `DataContractJsonSerializer`
directly to `HttpResponse.OutputStream`, which bypasses the existing
`JsonResult.Data` response body extraction.

Without this instrumentation, those endpoints skipped AAP API Security
traces.

## Implementation details

- Instruments
`System.Runtime.Serialization.Json.DataContractJsonSerializer.WriteObject(Stream,
object)`
- Captures after successful serialization, using the original graph
object instead of buffering response bytes.
- Requires the stream to be the current
`HttpContext.Response.OutputStream`, so serializing to `MemoryStream`,
files, or other streams are ignored.

## Test coverage

- Added unit coverage for DataContract member naming and over-capture
prevention.
- Added an MVC5 sample endpoint that returns a custom `ActionResult` and
calls `DataContractJsonSerializer.WriteObject(response.OutputStream,
data)`.
- Added API Security snapshots for the new MVC5 scenario with API
Security enabled and disabled.

## Other details

https://datadoghq.atlassian.net/browse/APPSEC-68123

---------

Co-authored-by: Daniel Romano <daniel.romanolorente@datadoghq.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

tracer/build/_build/Honeypot/IntegrationGroups.cs

@@ -26,6 +26,7 @@ static IntegrationMap()
             NugetPackages.Add("System", new string[] { });
             NugetPackages.Add("System.Diagnostics.Process", new string[] { });
             NugetPackages.Add("System.Runtime.Remoting", new string[] {  });
+            NugetPackages.Add("System.Runtime.Serialization", new string[] { });
             NugetPackages.Add("System.Security.Cryptography", new string[] { });
             NugetPackages.Add("System.Security.Cryptography.Primitives", new string[] { });
 

tracer/build/supported_calltargets.g.json

@@ -857,6 +857,81 @@
     "IsAdoNetIntegration": false,
     "InstrumentationCategory": 1
   },
+  {
+    "IntegrationName": "AspNet",
+    "AssemblyName": "System.Runtime.Serialization",
+    "TargetTypeName": "System.Runtime.Serialization.Json.DataContractJsonSerializer",
+    "TargetMethodName": "WriteObject",
+    "TargetReturnType": "System.Void",
+    "TargetParameterTypes": [
+      "System.Xml.XmlDictionaryWriter",
+      "System.Object"
+    ],
+    "MinimumVersion": {
+      "Item1": 4,
+      "Item2": 0,
+      "Item3": 0
+    },
+    "MaximumVersion": {
+      "Item1": 4,
+      "Item2": 65535,
+      "Item3": 65535
+    },
+    "InstrumentationTypeName": "Datadog.Trace.ClrProfiler.AutoInstrumentation.AspNet.DataContractJsonSerializer_WriteObject_XmlDictionaryWriter_Integration",
+    "IntegrationKind": 0,
+    "IsAdoNetIntegration": false,
+    "InstrumentationCategory": 2
+  },
+  {
+    "IntegrationName": "AspNet",
+    "AssemblyName": "System.Runtime.Serialization",
+    "TargetTypeName": "System.Runtime.Serialization.XmlObjectSerializer",
+    "TargetMethodName": "WriteObject",
+    "TargetReturnType": "System.Void",
+    "TargetParameterTypes": [
+      "System.IO.Stream",
+      "System.Object"
+    ],
+    "MinimumVersion": {
+      "Item1": 4,
+      "Item2": 0,
+      "Item3": 0
+    },
+    "MaximumVersion": {
+      "Item1": 4,
+      "Item2": 65535,
+      "Item3": 65535
+    },
+    "InstrumentationTypeName": "Datadog.Trace.ClrProfiler.AutoInstrumentation.AspNet.DataContractJsonSerializer_WriteObject_Integration",
+    "IntegrationKind": 1,
+    "IsAdoNetIntegration": false,
+    "InstrumentationCategory": 2
+  },
+  {
+    "IntegrationName": "AspNet",
+    "AssemblyName": "System.Runtime.Serialization",
+    "TargetTypeName": "System.Runtime.Serialization.XmlObjectSerializer",
+    "TargetMethodName": "WriteObject",
+    "TargetReturnType": "System.Void",
+    "TargetParameterTypes": [
+      "System.Xml.XmlWriter",
+      "System.Object"
+    ],
+    "MinimumVersion": {
+      "Item1": 4,
+      "Item2": 0,
+      "Item3": 0
+    },
+    "MaximumVersion": {
+      "Item1": 4,
+      "Item2": 65535,
+      "Item3": 65535
+    },
+    "InstrumentationTypeName": "Datadog.Trace.ClrProfiler.AutoInstrumentation.AspNet.DataContractJsonSerializer_WriteObject_XmlWriter_Integration",
+    "IntegrationKind": 1,
+    "IsAdoNetIntegration": false,
+    "InstrumentationCategory": 2
+  },
   {
     "IntegrationName": "AspNet",
     "AssemblyName": "System.Web",

tracer/build/supported_versions.json

@@ -57,6 +57,13 @@
       }
     ]
   },
+  {
+    "integrationName": "AspNet",
+    "assemblyName": "System.Runtime.Serialization",
+    "minAssemblyVersionInclusive": "4.0.0",
+    "maxAssemblyVersionInclusive": "4.65535.65535",
+    "packages": []
+  },
   {
     "integrationName": "AspNet",
     "assemblyName": "System.Web",
@@ -1550,4 +1557,4 @@
       }
     ]
   }
-]
+]