Endpoint route metadata that is applied and never evaluated might be problematic

[DamianEdwards]

It's very easy to add required endpoint metadata that won't be evaluated at all which in some cases could be a security issue (e.g. authorization) from the point of view of the user. Idea here is to enable marking metadata as requiring to be evaluated and if it isn't by execution, throw. This could also be codified at design/compile-time with analyzers.

@rynowak @davidfowl

[pranavkm]

Is this the same issue as #9041 or do we need a more general purpose way of signalling that a metadata was evaluated?

[rynowak]

This is the same as #9041 - we're just fixing this for the security-related metadata. I don't think we have try to extra a user-facing feature from this.

[pranavkm]

Closing as dup in that case.