CA2000: Rule does not trigger for IDisposable objects returned from factory methods in a different assembly

[ozziepeeps]

Analyzer

Diagnostic ID: CA2000: Dispose objects before losing scope

Analyzer source

SDK: Built-in CA analyzers in .NET 5 SDK or later

Version: SDK 9.0.200

Describe the bug

The CA2000 rule currently does not trigger for objects implementing IDisposable when they are returned from a method, such as a factory method in a different assembly. This behavior is inconsistent, as the rule correctly triggers for IDisposable objects that are instantiated locally to the consuming type. This can lead to potential resource leaks, as these objects may not be disposed of correctly.

Steps To Reproduce

1. I have provided a repro in a GitHub repo here: https://github.com/ozziepeeps/DisposableIssue
2. Open the solution, build, and observe that only two instances of CA2000 are triggered. There should be four, per the comments

Expected behavior

CA2000 is triggered for all cases (four times)

Actual behavior

CA2000 is triggered for two out of the four cases - the two cases that are local to the type

Additional context

[ozziepeeps]

This is likely related to #7487, which discusses the issue with IAsyncDisposable vs this issue that is for IDisposable