[Validation] Analyzer diagnostics for authentication state

**Scenario contact:** @ilonatommy

## Scenario

A component that reads the signed-in user once keeps showing the old user after sign-in or sign-out, because it never asked to be told when that changes. The symptom appears far from the cause: stale names, stale roles, and content shown to the wrong person. This validates that the build now warns about it, and that following the advice actually fixes the behavior.

## Minimum build

.NET 11 Preview 7 or later.

## Configurations to cover

* Blazor Web App
* [ ] Static SSR
* [x] Interactive Server
* [ ] Interactive WebAssembly
* [ ] Interactive Auto
* [ ] Standalone WebAssembly
* [ ] Hybrid (MAUI)

These diagnostics are produced by the compiler, so they do not vary by render mode. The configuration below is the one needed to reproduce the runtime behavior the warning predicts, not a matrix to work through.

## Also exercise

* [ ] Published output
* [ ] An existing .NET 10 app upgraded to .NET 11
* [ ] Trimming or ahead-of-time compilation
* [ ] More than one server instance, or a proxy in front
* [ ] Hot Reload
* [x] An IDE as well as the command line
* [ ] Container

## Setup

The app needs authentication that you can sign in and out of while it is running, so that the signed-in user genuinely changes without a full reload.

The diagnostic this scenario covers is:

| Id | Title | Code fix |
|---|---|---|
| `BL0013` | `AuthenticationStateProvider.GetAuthenticationStateAsync` used without subscribing to `AuthenticationStateChanged` | No |

## What to build

Two places that read the signed-in user, because the reported problem covers both:

* **A component** that calls `GetAuthenticationStateAsync` once when it starts, stores the user in a field, and shows the name and roles, without subscribing to `AuthenticationStateChanged`.
* **A DI service** that does the same: injects `AuthenticationStateProvider`, caches the resulting user in a field, and hands it out to whatever asks. Register it as scoped and call it from a page.

Put `` and `` alongside them. Those two subscribe internally, so they keep up with changes and give you a live comparison on the same page.

Add a component that subscribes properly and unsubscribes on disposal, so a correct version sits next to the broken ones.

## Things to try

* Building at the command line and in an IDE, and reading the messages that appear.
* Signing in and out while the page is open, without reloading the browser.
* Comparing what the component, the service and the `` show at the same moment.
* Subscribing to `AuthenticationStateChanged` in both the component and the service, then repeating the sign-in and sign-out test.
* The correctly written component, to confirm it produces no warning.
* Reading the state from a cascading parameter instead, to see whether that is flagged.
* Navigating away from the page and back after signing in as a different user.

## Expected behavior

The problem is reported at build time in both a component and a service, and subscribing fixes the runtime behavior the warning predicted.

### Must hold

* Both the component and the service produce a `BL0013` warning at the correct line. The service matters: a cached user in a long-lived service is the case the report called out alongside components.
* Before subscribing, both still show the previous user after signing in or out, while `` on the same page shows the new one.
* After subscribing, both track the signed-in user without a reload.
* The correctly written component produces no `BL0013` warning, and neither does `` or ``.
* The warning appears both at the command line and in the IDE, at the same line.

### Expected differences between configurations

* None. The warning is produced at compile time and is identical in every configuration.

## Documentation to use

* [AuthenticationStateProvider service](https://learn.microsoft.com/aspnet/core/blazor/security/authentication-state?view=aspnetcore-11.0)

## What to report

Report results using the format described in the [validation testing manual](https://github.com/dotnet/aspnetcore/issues/68479). Include link to a repository with the test app.