Make the test suite runnable without an ASP.NET Core runtime

The 11 tests built but could not execute: the plugin framework-references
Microsoft.AspNetCore.App through Jellyfin.Controller, that reference flows into
anything referencing the plugin, and the test host then demanded a web runtime
even for tests that touch no web type. This box has none at any version, and
Arch packages only 8 and 10 -- so "install the runtime" was neither available
here nor a clean answer.

DisableTransitiveFrameworkReferences drops the inherited reference. .NET
resolves assemblies lazily, so pure-logic types load without it. This is a
T1-tier decision rather than a workaround: requiring a web runtime to test
string and rule logic is incidental coupling. T2 -- controllers and
authorisation -- genuinely needs it, and belongs in a second project that keeps
the reference.

All 11 now pass. The suite was also checked to FAIL: removing the
newline-stripping from RemoveInjection fails UT-001 and nothing else, then the
source was restored and re-verified byte-identical. A suite that has only ever
passed is not evidence that it tests anything.

JR-016 and JR-022 therefore reach Done -- implemented and verified by tests
that execute. JR-023 stays In Progress: its detection branch has no test and
its config-page half is T4.

TRACES: JR-016, JR-022 | PR-003, PR-004

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Jellyfin.Plugin.JRay.Tests/Jellyfin.Plugin.JRay.Tests.csproj

@@ -20,6 +20,18 @@
       and on CI without pinning either to a runtime that is not the plugin's.
     -->
     <RollForward>LatestMajor</RollForward>
+    <!--
+      The plugin framework-references Microsoft.AspNetCore.App through
+      Jellyfin.Controller, and that reference flows into anything referencing
+      the plugin. The T1 tier tests pure logic that touches no web type, so
+      inheriting the web framework would make the suite unrunnable on any box
+      without the ASP.NET Core runtime for no benefit. .NET resolves assemblies
+      lazily, so types that never touch ASP.NET load fine without it.
+
+      T2 (controllers, authorisation) genuinely needs that runtime. When those
+      tests arrive they belong in a second project that keeps this reference.
+    -->
+    <DisableTransitiveFrameworkReferences>true</DisableTransitiveFrameworkReferences>
   </PropertyGroup>
 
   <ItemGroup>