Add unit tests for `DeserializationGuard`

[JVBotelho]

Summary

DeserializationGuard has no dedicated unit test file — only indirect coverage via
integration tests. Add Rasp.Core.Tests/Guard/DeserializationGuardTests.cs covering its own
block/audit/no-threat/no-op branches in isolation.

Background

Every *DetectionEngine has a dedicated test file; most Guard classes don't. This is one
of five identical-shaped issues — see docs/good-first-issues-dotnet.md for the full list
and the shared rationale (this is about naming concrete gaps, not chasing a coverage
percentage).

Pattern to copy

Rasp.Core.Tests/Guard/SqlSinkGuardTaintTests.cs — NoOpRaspMetrics fake, a real
RaspAlertBus, Options.Create(new RaspOptions {...}), NullLogger<T>.Instance.

What to test

AnalyzeType(Type? typeToDeserialize, context)
(src/Rasp.Core/Guard/DeserializationGuard.cs), gated by RaspOptions.BlockOnDetection:

• Threat detected + audit mode: alert pushed via RaspAlertBus, no exception thrown.
• Threat detected + block mode: RaspSecurityException thrown, alert still pushed before the throw.
• No threat: no alert, no exception.
• No-op case: null type never reaches the engine or calls _metrics.RecordInspection.