[release/9.0] Ensure required properties are validated before invoking the deserialization constructor.

[github-actions]

Backport of #107083 to release/9.0

/cc @eiriktsarpalis

Customer Impact

• Customer reported
• Found internally

.NET 9 introduces the JsonSerializerOptions.RespectRequiredConstructorParameters property that enables treating non-optional constructor parameters as required in the JSON payload when deserializing an object. This builds upon existing infrastructure for properties marked required. It has been reported by a customer that this validation is being run after the deserialization constructor has been invoked, meaning that uninitialized parameters could be passed to the constructor even with validation turned on. The issue typically manifests as exceptions being surfaced from the constructor itself (NRE or ArgumentException usually) as opposed to the expected JsonException detailing which required parameter is missing from the payload.

Regression

• Yes
• No

Testing

Added unit testing validating the impacted use case.

Risk

Low. The change is a straightforward moving of required parameter validation to the top of the deserialization methods. Pedantically speaking this could be seen as a behavior change in cases where deserialization constructors perform side-effects, however that's an unlikely scenario we don't want to condone or support.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-text-json, @gregsdennis
See info in area-owners.md if you want to be subscribed.

[jeffhandley]

/ba-g The failures are known and unrelated

[artl93]

approved.