Make sure CheckAndThrow is invoked only within ambient Cancellable context

[majocha]

See: #18002 (comment)

Basically, when Cancelable.CheckAndThrow() throws the exception, we don't want the exception to leak.
It should be caught inside Cancellable.run here:

fsharp/src/Compiler/Utilities/Cancellable.fs

Lines 44 to 52 in e44ae1d

	let inlinerun(ct:CancellationToken)(Cancellable oper)=
	if ct.IsCancellationRequested then
	ValueOrCancelled.Cancelled(OperationCanceledException ct)
	else
	try
	use _ = Cancellable.UsingToken(ct)
	oper ct
	with:? OperationCanceledException as e ->
	ValueOrCancelled.Cancelled(OperationCanceledException e.CancellationToken)

The idea of CheckAndThrow is that it is invoked from code that is unaware of Cancellable CE somewhere deeper on the callstack.
This PR checks the static AsyncLocal<CancellationToken voption> token. If it is default VNone, we know the invocation is outside of Cancellable. If there is a token present, we know Cancellable.run deeper on the stack has set it and we're good.

With this PR, internal error will occur whenever CheckAndThrow is called outside of Cancellable CE context.

• Added test.
• Runtime check can be disabled by setting DISABLE_CHECKANDTHROW_ASSERT env variable. I tested manually that it works.

[github-actions]

❗ Release notes required

---

✅ Found changes and release notes in following paths:

Change path	Release notes path	Description
src/Compiler	docs/release-notes/.FSharp.Compiler.Service/9.0.200.md

[auduchinok]

Maybe it'd make sense to have this assert not in the tests only? I can imagine some FCS APIs that may trigger analysis and that don't take a cancellation token. If there're no tests for such APIs, it's going to be very difficult to uncover these, as they'd only manifest themself when cancelled at some unfortunate moment. The sooner we catch all these exceptions, the better.

Maybe we could have some global property or other way to control it. With this way we'd enable these asserts in the internal and EAP Rider builds, but could turn it off just in case in the release ones, at least for the time being.

[majocha]

TBH my initial thought was to just put a hard failwith where the assert is. It would surface as a internal error (see the failing tests) if CheckAndThrow is misused anywhere. This would be immediately discoverable.

[majocha]

Added DISABLE_CHECKANDTHROW_ASSERT env variable that can be set in case of emergencies.

[psfinaki]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[psfinaki]

@majocha do I get it right that the TODO in the description is already done?

[majocha]

@majocha do I get it right that the TODO in the description is already done?

Yes, forgot to edit this.