v5.0.0: System.Text.Json default, remove Newtonsoft, trusted publishing

[Mako88]

Summary

Major release. Moves the default JSON serializer from Newtonsoft.Json to System.Text.Json, removes the Newtonsoft.Json dependency entirely, and switches the release workflow to NuGet trusted publishing (OIDC) so we no longer rely on a long-lived API key.

This is the breaking follow-up to 4.2.0, which added SimpleHttpSystemTextJsonSerializer as an opt-in.

Library changes (breaking)

• SimpleHttpDefaultJsonSerializer now derives from SimpleHttpSystemTextJsonSerializer (System.Text.Json). The client's default serialization is now STJ. SimpleHttpSystemTextJsonSerializer is retained for callers who reference it explicitly.
• Newtonsoft.Json PackageReference removed; System.Text.Json retained.
• Version → 5.0.0 (csproj; the workflow computes the published version from the release:major label + latest tag).

Migration notes

System.Text.Json is stricter than Newtonsoft.Json. Watch for:

• Non-public parameterless constructors — STJ won't use them; add a public ctor or [JsonConstructor].
• Polymorphic/variable-shape fields — a field that's sometimes a string and sometimes an object throws under STJ where Newtonsoft coped.
• Need the old behavior? Implement ISimpleHttpSerializer with a Newtonsoft serializer and set it on the client.

Tests

• Converted the suite off Newtonsoft: JToken/JObject → System.Text.Json.Nodes, JsonConvert → JsonSerializer.
• The postman-echo data field is an empty string on form posts but an object on JSON posts — re-typed the test model field as JsonNode? so STJ accepts both (this surfaced the strictness difference above).
• Default-serializer output test made line-ending agnostic (STJ newline differs by platform).
• Green on net10.0 (85) and net48 (85).

Release workflow → trusted publishing

• Added id-token: write permission.
• Added a NuGet/login@v1 step that exchanges the OIDC token for a short-lived API key right before push; push now uses that key instead of secrets.NUGET_API_KEY.

⚠️ Required before merging (maintainer)

1. On nuget.org → account → Trusted Publishing, add a policy: Repository Owner Mako88, Repository SimpleHttpClient, Workflow File release.yml, Environment empty.
2. Add a repo secret NUGET_USER = your nuget.org username (profile name, not email).
3. The old NUGET_API_KEY secret can be deleted afterward.

🤖 Generated with Claude Code

[Mako88]

I attempted to approve this, but GitHub rejected it because the PR author and reviewer are the same account. For the record, after reviewing the diff I did not find any blocking issues.

Highlights from the review:

• The v5 breaking change is clearly documented and appropriately scoped for a major release.
• SimpleHttpDefaultJsonSerializer now delegates to the System.Text.Json implementation while preserving the public type, which minimizes migration friction.
• The migration notes correctly call out the biggest Newtonsoft → STJ behavior differences.
• Test coverage was expanded around the new serializer behavior (quoted numbers, comments/trailing commas, enum serialization, non-public constructors, etc.).
• The trusted publishing workflow change looks sound and removes reliance on a long-lived API key.
• CI is green on the current head commit.

Only minor observation: InternalsVisibleTo was added to test internal provider selection. That's reasonable, though it does create some coupling between tests and implementation details. Not a blocker.

If I were reviewing this as a separate GitHub user, this would be an approval from me.