System.Security readonly annotation

[hrrrrustic]

This PR is a part of #46675

[dotnet-issue-labeler]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

This PR is a part of #46675

Author:	hrrrrustic
Assignees:	-
Labels:	area-System.Security, new-api-needs-documentation
Milestone:	-

[GrabYourPitchforks]

Thanks for submitting this! At first glance my gut tells me that these changes may cast too wide a net. For example, one of the modified types is a ref struct "reader" type, and it's never expected for such types to be passed via "in" parameters.

As Steve said in the original issue, we also want to ensure that for our public APIs, the newly annotated methods will never at any point in the future need to modify state. So we'll need to confer on these to narrow down what public API contract changes would be appropriate to take as a long-term behavioral guarantee.

[jeffhandley]

This PR is being marked as a draft per #46675 (comment).

[ghost]

Draft Pull Request was automatically closed for inactivity. Please let us know if you'd like to reopen it.