Fix assembly definition public key token computation

[jmbryan4]

Fixes #311.

What

assemblyDef.PublicKey holds the full RSA public key (~160 bytes). The correct PKT derivation (ECMA-335 §6.2.1.3) is:

1. SHA-1 hash the full public key
2. Take the last 8 bytes of the hash
3. Reverse those 8 bytes

The previous code took the last 8 raw bytes of the key itself, producing a wrong value for every strong-named assembly.

Verification

The correct PKT can be independently verified at nuget.info — the publicKeyToken shown there matches the fix's output, not the old output.

Assembly	Correct PKT	Old (wrong) output
System.Text.Json	cc7b13ffcd2ddd51	1d05d9bed22b38cb
System.Private.CoreLib	7cec85d7bea7798e	85b4305c123b37ab
System.Linq	b03f5f7f11d50a3a	6dc093344d5ad293
Microsoft.Extensions.Logging.Abstractions	adb9793829ddae60	07891c9d872ad2bb

Changes

• src/DotnetInspector.Metadata/AssemblyInspector.cs — apply correct SHA-1 + reverse algorithm
• tests/DotnetInspector.Metadata.Tests/AssemblyInspectorTests.cs — regression test comparing against AssemblyName.GetPublicKeyToken()
• scripts/baseline.txt, docs/lap-around.md — update expected PKT values for System.Text.Json

[richlander]

Thanks @jmbryan4 — the PKT computation fix is correct (SHA-1 → last 8 → reverse, per ECMA-335 §6.2.1.3) and the regression test against AssemblyName.GetPublicKeyToken() is a great way to lock it in.

The pack smoke-test failure was unrelated to your change — it's a .NET 11 preview 3 SDK regression where redirecting an AOT binary's stdout via > truncates output to ~256 bytes. It was hitting every PR until I fixed it on main in #317. I've pushed a single commit to your branch (with maintainerCanModify) that brings in the same | cat > file workaround to your CI smoke tests.

Once CI re-runs (it's currently action_required because the commit touches the workflow file from a fork), this should be ready to merge.

[richlander]

Change is in 0.7.8.

Thanks!