Improve IL comparison normalization and auditability

[Widthdom]

Summary

• normalize build-variant IL values, including multiline ilspycmd type-library timestamp blobs
• remove ShouldIgnoreMVID and always normalize MVIDs as built-in build-variant IL data
• compare reordered methods within a class without hiding method-body changes
• report configured normalization and ignored-line rule application counts in the audit log
• document when different *_IL.txt files can still produce an IL match
• update vulnerable transitive JavaScript dependencies detected by the CI audit gate

Why

Disassembler output contains build-dependent values that can create false differences. MVIDs have the same build-variant nature as RVA, code-size, and type-library timestamp values, so keeping a separate opt-out made comparison behavior inconsistent. In addition, treating an entire class as one opaque block made method-order-only changes appear different, while the configured IL transformations were not sufficiently auditable.

The JavaScript audit gate also began rejecting locked vulnerable versions of brace-expansion and js-yaml. The package overrides retain each existing major version while selecting its patched release.

Impact

This includes a deliberate breaking configuration/API change: ShouldIgnoreMVID has been removed. MVID lines are no longer deleted conditionally; their build-dependent value is always replaced by the built-in stable MVID marker. Consumers that referenced the property in code must remove that reference. Existing configuration files should also remove the obsolete setting.

Built-in normalization now handles the observed output formats from dotnet-ildasm 0.12.2 and ilspycmd 9.1.0.7988. The multiline ilspycmd timestamp attribute is collapsed to one stable marker while malformed or unterminated blobs remain comparable as raw IL. Class member order no longer affects comparison, but method-body changes and bodies moved between different methods remain differences.

Configured normalization and ignore rules record bounded per-file application summaries. With IL text output enabled, counts are collected during the existing materialization pass. Without IL text output, a separate non-retaining audit pass adds CPU work while preserving the streaming comparison memory profile apart from bounded summaries.

Validation

• Release build: succeeded with 0 warnings and 0 errors
• Release tests: 2,099 passed, 10 skipped, 0 failed
• JavaScript tests: 190 passed, 0 failed
• npm audit: 0 vulnerabilities in all and production-only dependencies
• adversarial review: no actionable correctness regressions identified