Add an analyzer that warns on single-use JsonSerializerOptions instances

[eiriktsarpalis]

Forked from #40072.

While #64646 mitigates most of the performance issues related to creating single-use JsonSerializerOptions instances, this is still a suboptimal pattern and users are better off working with singleton JsonSerializerOptions instances. We should add an analyzer that warns about any JsonSerializerOptions construction that flows only to a call to a JsonSerializer method argument.

The analyzer should warn if any of the following patterns are detected:

JsonSerializer.Serialize(value, new JsonSerializerOptions { /* some custom config */ });

or if we're passing a local that has been initialized in the same method

var options = useDefault ? JsonSerializerOptions.Default : new JsonSerializerOptions { /* some custom config */ };

foreach(object value in values)
{
    JsonSerializer.Serialize(value, options);
}

In both cases the analyzer should recommend lifting the options instance to a static variable or use DI, but would most likely not provide a fixer.

Tagging subscribers to this area: @dotnet/area-system-text-json
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Forked from #40072.

While #64646 mitigates most of the performance issues related to creating single-use JsonSerializerOptions instances, this is still a suboptimal pattern and users are better off working with singleton JsonSerializerOptions instances. We should add an analyzer that warns about any JsonSerializerOptions construction that flows only to a call to a JsonSerializer method argument.

Author:	eiriktsarpalis
Assignees:	-
Labels:	area-System.Text.Json, tenet-performance, code-analyzer
Milestone:	Future

[timmydo]

@jeffhandley @eiriktsarpalis would be great if we could get something like this. We have an issue in our codebase where a dev passed a new options object to the Serialize method every time and it caused a lot of CPU due to jitting and other things. This could have been caught with an analyzer.

[eiriktsarpalis]

Related to #31094 (comment). Ultimately this and other issues stem from ergonomic concerns with the existing static JsonSerializer methods. One possible alternative might be to use a DI approach and obsolete static methods accepting JsonSerializerOptions.