CA1416 doesn't work when Microsoft.CodeAnalysis.NetAnalyzers is referenced directly with EnableNETAnalyzers=false

[amaltinsky]

AFAIK, the EnableNETAnalyzers property controls whether the SDK's built-in analyzers are used during compilation, and setting it to false used to be the best practice when using a specific version of analyzers, to avoid duplication and inconsistency.

When EnableNETAnalyzers is set to false, Microsoft.CodeAnalysis.NetAnalyzers v8.0.0 used to correctly trigger CA1416 warnings where applicable. However, with v10.0.103, this no longer happens, and I have to set EnableNETAnalyzers to true for it to trigger now. Please see the reproduction code here. This seems like a bug.

Moreover, while v8.0.0 used to set EnableNETAnalyzers to false in buildTransitive\DisableNETAnalyzersForNuGetPackage.props, net10 versions stopped doing that, so both the packaged and the SDK's analyzers get fed into the compiler. Is that the intended behavior?

[amaltinsky]

I believe that this should be tagged as Microsoft.CodeAnalysis.NetAnalyzers