Update Npgsql dependency to 9.0

[eerhardt]

The Aspire.Npgsql client integration package depends on the Npgsql package. Npgsql just shipped a 9.0.0 version on nuget:

https://www.nuget.org/packages/Npgsql/9.0.0

The Npgsql 9.0.0 still supports net8.0, so we could unconditionally depend on the 9.0.0 version.

However, the 9.0.0 version depends on System.Text.Json 9.0.0:

If we referenced this package from our net8.0 TFM, it would mean any .NET Aspire app using our client integration package would get the v9.0 version of System.Text.Json. This means that System.Text.Json would always be "app local" for the app, which has the following drawbacks:

• It is no longer serviced by the shared framework. So when a new vulnerability / patch fix is shipped, every app will need to re-deploy in order to take advantage of the new fix - you can't just update the shared framework for servicing.
  • Note that we default to using containers, so this is less of a concern since you always need to re-deploy your container to get a new shared framework version.
• System.Text.Json is no longer "ready to run" AOT'd. Which means the app starts slower because the Json code needs to be JIT'd on startup.
• The app size is larger, since it contains an extra version of System.Text.Json.

We should decide how to update our dependency on Npgsql. I think we have 2 high-level choices:

1. Split which version we depend on, depending on TFM. This is similar to how we support EntityFramework integration packages.
2. Unconditionally depend on the 9.0 version, and live with the above drawbacks.

@DamianEdwards @joperezr @roji

[roji]

@NinoFloris actually debated this quite a bit - FWIW we ended up going with STJ 9.0 to allow people to take advantage of the new out-of-order metadata reads, which are particularly useful for the PostgreSQL jsonb type (which doesn't preserve property ordering...)... Allowing this to people still on net8.0 seemed valuable enough...

[roji]

@eerhardt and others, please hold off on doing something here - there are some other issues with referencing STJ 9.0 (namely, we still target net6.0 for backwards compat, and STJ 9.0 emits "untested" warnings - npgsql/npgsql#5940). So we're going to release a 9.0.1 immediately which no longer references STJ 9.0, but rather uses reflection to access AllowOutOfOrderMetadataProperties. This way, 8.0 users can choose to reference STJ 9.0 if they wish, but it's an explicit opt-in (i.e. by default Npgsql 8.0 would get the in-the-box STJ).

[roji]

FYI 9.0.1 is out, without the dependency on STJ 9.0.1 - so I think this can be closed...