fix: address 8 bugs from security and correctness audit

[jzills]

Summary

This PR resolves 8 bugs identified in a security and correctness audit across all four cache backends. Each bug has a corresponding unit test confirming the issue before the fix and passing after.

---

Bugs Fixed

C1 — Deserialization gadget-chain risk in CacheJsonSerializer

File: src/Common/Serialization/CacheJsonSerializer.cs, SafeSerializationBinder.cs, ActionArgumentsConverter.cs

TypeNameHandling.All embedded $type in every payload and honored it unconditionally on deserialization. An attacker with write access to the cache backend could plant a Newtonsoft.Json gadget-chain payload and trigger arbitrary code execution on the next GetAsync call.

Fix: Switched to TypeNameHandling.Auto (only embeds $type when the runtime type genuinely differs from the declared type — e.g. IActionResult → OkObjectResult) combined with a SafeSerializationBinder that restricts deserialization to already-loaded assemblies and explicitly blocks known gadget-chain namespaces (System.Windows, System.Workflow, System.Web.Security, Microsoft.Exchange, Microsoft.IdentityModel). Also passes typeof(T) to SerializeObject and typeof(object) in ActionArgumentsConverter.WriteJson so the declared type is always visible to the serializer. This is a substantial improvement over the original: $type is emitted far less often, and every $type read during deserialization is validated before any type is instantiated.

---

C4 — Race condition: shared mutable Namespace.ValueWithRouteTemplateParameters

File: src/Common/Utilities/Namespace.cs

ValueWithRouteTemplateParameters was a plain { get; set; } on a record class. When a Namespace instance is shared across concurrent requests, one request's AttachRouteValues call could overwrite another's resolved route value — last writer wins — producing wrong cache keys or evicting the wrong resource.

Fix: The property is now backed by AsyncLocal<Dictionary<string, string?>> keyed by namespace Value. Each async execution context (i.e. each request) gets its own resolved value; concurrent requests cannot interfere.

---

C5 — Misleading name: HasExpiredSlidingExpiration does not check expiration

File: src/Common/Caching/ActionCacheEntryOptions.cs

The method only called HasExpirationValue(value) — checking whether a sliding window is configured (> 0), not whether it had elapsed. The name implied a time comparison symmetrical with HasExpiredAbsoluteExpiration, which would mislead future maintainers.

Fix: Renamed to HasSlidingExpiration. Updated both call sites in RedisActionCache.cs and AzureCosmosCache.cs.

---

H2 — Null reference: ActionCacheKeyBuilder.WithActionArguments

File: src/Common/Keys/ActionCacheKeyBuilder.cs

Passing null as actionArguments caused an immediate NullReferenceException on actionArguments.ToDictionary().

Fix: Added if (actionArguments is null) return this; — null is treated as "no arguments provided".

---

H4 — Silent write failures: CommandFlags.FireAndForget in RedisActionCache.SetAsync

File: src/Redis/RedisActionCache.cs

The primary SetAsync path passed CommandFlags.FireAndForget to ScriptEvaluateAsync. Any network error, Redis OOM, or Lua error was silently discarded — callers had no way to know the write failed.

Fix: Removed CommandFlags.FireAndForget. The awaited result now surfaces failures normally.

---

H5 — TTL truncation: integer division in AzureCosmosActionCache.SetAsync

File: src/AzureCosmos/AzureCosmosCache.cs

ttl / 1000 (ms → s) used integer division, silently truncating sub-second values: 1 500 ms → 1 s, 999 ms → 0 s (no expiry). Cache entries expired earlier than configured.

Fix: Changed to (long)Math.Ceiling(ttl / 1000.0).

---

H7 — Silent lock failures: empty else branches in CacheLockerBase

File: src/Common/Concurrency/CacheLockerBase.cs

Both WaitForLockThenAsync overloads had empty else { // Handle lock acquisition failure } branches. A failed lock acquisition silently skipped the protected operation — callers could not distinguish a successful write from one that never happened.

Fix: Both branches now throw InvalidOperationException with the resource name so callers can apply their own recovery strategy.

---

M7 — Lock settings dropped by factory Create(ns, abs, slide) overloads

Files: src/Memory/MemoryActionCacheFactory.cs, src/Redis/RedisActionCacheFactory.cs, src/SqlServer/SqlServerActionCacheFactory.cs

All three factories constructed a fresh ActionCacheEntryOptions with only expiration fields set, silently resetting any configured LockDuration and LockTimeout back to their 5 s / 10 s defaults.

Fix: The overloads now copy LockDuration and LockTimeout from the global EntryOptions.

---

Test Plan

• All 387 unit tests pass (dotnet test test/Unit/Unit.csproj) on net8.0 and net9.0
• All 46 integration tests pass on net8.0; 4 Test_ActionCache_Expiration_Sliding failures on net10.0 are pre-existing (unrelated to this PR — none of the changed files touch the sliding expiration reset path)
• New test files: CacheJsonSerializerTests, CacheLockerBaseTests, AzureCosmosActionCacheTtlTests
• Updated test files: ActionCacheEntryOptionsTests, NamespaceTests, RedisActionCacheTests, RedisActionCacheFactoryTests, SqlServerActionCacheFactoryTests, ActionCacheKeyBuilderTests