What kind of change does this PR introduce?

Build / tooling and the code changes needed to satisfy it: adopts the StyleSharp / PerformanceSharp / SecuritySharp analyzer suite, refreshes the shared .editorconfig, updates NuGet dependencies, and fixes every resulting analyzer finding.

What is the new behavior?

• Adopts the full analyzer suite. Adds SecuritySharp.Analyzers and PerformanceSharp.Analyzers, and bumps StyleSharp.Analyzers to 3.38.1 (the three ship from one pipeline and share a version). They are referenced for every project alongside the existing analyzers.
• Adapts the .editorconfig from ReactiveUI. Brings over the shared, suite-aware configuration, keeping Splat's own file header and its Platforms/TypeForwardedSystemDrawing.cs (RS0041) exemption. Overlapping legacy analyzer rules are pointed at the suite's canonical rule and a handful are scoped to none where they describe a deliberate Splat pattern (the allocation-free logging overloads, marker/tag interfaces, retained obsolete APIs, generic-cache factory methods, and the generic service-locator API).
• Updates NuGet dependencies to their latest compatible stable versions (checked against nuget.org, obeying the per-TFM constraints already encoded in the packages file): ReactiveUI.Disposables 7.0.0, Serilog 4.4.0, TUnit 1.61.29, Verify.TUnit 31.27.0, the Microsoft.Extensions.* / System.* 10.0.10 set, SourceLink 10.0.301, Raygun 11.2.6, and the analyzer bumps above. Prereleases were skipped in favor of the latest stable.
• Fixes every analyzer finding across product and test code rather than suppressing it. Where an existing suppression targeted a legacy rule that the suite now supersedes, the suppression is swapped to the canonical suite rule (or removed when its twin is disabled). Highlights: the generic service-locator / logging APIs carry justified type-level suppressions (the type parameter is the caller-supplied contract by design); interlocked-field reads use Volatile.Read; dictionary get-or-add uses CollectionsMarshal.GetValueRefOrAddDefault on net6+; SplatColor is now genuinely immutable; a System.Index polyfill is added for the net4x from-end-index usages; test methods that asserted nothing gained real assertions. Files were re-saved as UTF-8 without a BOM.

What is the current behavior?

Only StyleSharp.Analyzers (3.5.2) from the suite was referenced; the .editorconfig predated the suite migration; several dependencies were behind their latest stable.

What might this PR break?

• Microsoft.ApplicationInsights is intentionally held at 2.23.0, not the 3.x latest. AI 3.x removed PageViewTelemetry, which Splat.ApplicationInsights exposes on its public API (OnViewNavigation(PageViewTelemetry) / GetPageViewTelemetry()); adopting 3.x would be a breaking change to Splat's own public surface, so the bump was reverted. Every other package went to its latest compatible stable.
• Numerous internal members were tightened from public to internal (their containing type is not public) — no public API change.
• One test-support parameter was renamed to match its base member; the tracked PublicAPI.Shipped.txt files were updated to match.
• All source files are now UTF-8 without a BOM.
• Changes are intended to be behavior-preserving; the full test suite passes.

Additional information

• The full solution builds clean (-warnaserror) across every target framework the host can build: net8/9/10/11, net462/472/481 (reference), net*-android, and net*-windows.
• The entire test suite passes.