Add request-scanning middleware, harden filter, rebrand to SpitFire

[bsaranga]

Summary

Adds a middleware-based alternative to the MVC action filter, fixes several latent crash/perf bugs in the existing filter, and rebrands the package from Zone24x7 to SpitFire.

Filter hardening

• Skip null action arguments and null collection items instead of throwing (optional/unbound parameters no longer 500 the request)
• Reference-based, path-scoped cycle detection so cyclic object graphs terminate instead of stack-overflowing at the default infinite recursion depth
• Read each property value once instead of up to three GetValue calls
• Cache PropertyInfo per type to avoid re-reflecting on every request
• Guard AttributeRouteInfo for convention-routed controllers
• Wire up the previously-dead WhiteListEntry.ExclusionPattern

New: request-scanning middleware

PayloadInjectionMiddleware runs before model binding and scans the raw query string and request body, so it covers minimal APIs, Razor Pages and gRPC in addition to MVC controllers.

• AddPayloadInjectionMiddleware / UsePayloadInjectionMiddleware helpers
• Method gating, per-path exclusions, query/body scan toggles
• URL-decodes the query string to catch percent-encoded payloads
• Buffers and rewinds the body so downstream endpoints can re-read it
• Rejects bodies larger than MaxScannedBodyBytes with 413

Rebrand

• Namespace Zone24x7PayloadExtensionFilter → SpitFirePayloadExtensionFilter
• PackageId Zone24x7.PayloadInjectionFilter → SpitFire.PayloadInjectionFilter
• Version bumped to 0.1.0

Note: the new PackageId means the next publish creates a new NuGet listing rather than versioning the old one.

Docs

• Filter-vs-middleware comparison and middleware usage section
• Documented the now-functional ExclusionPattern
• Honest scope note (defense-in-depth, not a WAF / output-encoding replacement)
• Reliability notes (cycle safety, null handling, caching)

Tests

31 → 41 passing. New tests cover null arguments, cyclic graphs, ExclusionPattern, and the full middleware surface (body/query short-circuit, body rewind, method gating, path exclusion, custom response, oversized 413).

🤖 Generated with Claude Code