Sdk: Package analyzers always included, ignoring exclude settings

[natemcmaster]

NuGet provides the "ExcludeAssets" setting to allow excluding analyzers from packages. However, it appears the SDK still includes analyzers in the build even if excluded.

(cref https://docs.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#controlling-dependency-assets)

Repro

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <TargetFramework>netcoreapp2.0</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="15.0.0" />
    <PackageReference Include="xunit" Version="2.2.0" />
    <PackageReference Include="xunit.runner.visualstudio" Version="2.2.0" />

    <PackageReference Include="xunit.analyzers" Version="0.1.0" ExcludeAssets="analyzers" />

  </ItemGroup>

</Project>

```c#
using System;
using Xunit;

namespace test1
{
public class UnitTest1
{
[Fact]
public void Test1(string data) // this line intentionally trips an error in xunit.analyzers...just to prove the analyzer is running
{
}
}
}

dotnet restore
dotnet build

**Expected**
The analyzer in `xunit.analzyers/0.1.0/analyzers/dotnet/cs/xunit.analyzers.dll` should not have been passed to CSC, and build succeeds.

**Result**

Build FAILED.

UnitTest1.cs(9,21): error xUnit1001: Fact methods cannot have parameters [C:tmptest1test1.csproj]
0 Warning(s)
1 Error(s)

**Details**
Using dotnet.exe 2.0.0-preview2-006067

project.assets.json file contains:
```js
{
  // ...
  "libraries": {
    "xunit.analyzers/0.1.0": {
      "sha512": "wPHthUmM0vdhL3lrTlyxJFfTgGh+2bkOn5CuxgZaPEMxLJArMCvUx8WmsVFeIATLVulVGvwNnZFkuwc0lsun7g==",
      "type": "package",
      "path": "xunit.analyzers/0.1.0",
      "files": [
        "analyzers/dotnet/cs/xunit.analyzers.dll",
        "tools/install.ps1",
        "tools/uninstall.ps1",
        "xunit.analyzers.0.1.0.nupkg.sha512",
        "xunit.analyzers.nuspec"
      ]
    }
  },
  // ...
  "project": {
    "frameworks": {
      "netcoreapp2.0": {
        "dependencies": {
          // ...
          "xunit.runner.visualstudio": {
            "target": "Package",
            "version": "2.2.0"
          },
          "xunit.analyzers": {
            "include": "Runtime, Compile, Build, Native, ContentFiles",
            "target": "Package",
            "version": "0.1.0"
          },
          // ...
        }
      }
    }
  }
}

[natemcmaster]

Ping @nguerrera. Still happening in 2.0.0-preview3-006609

cc @rrelyea

[natemcmaster]

cc @mikeharder

[Cryowatt]

This issue also occurs when a project includes a package that excludes analyzes from it's .nuspec. The solution ends up including the nested dependency analyzers and I get IDE1002 errors during the build.

[nguerrera]

Blocked by https://github.com/NuGet/Home/issues/6279

[aidapsibr]

I'm encountering this in a conversion to the new SDK style projects. The change in behavior of transitive dependencies means that a single package with an analyzer is now breaking our builds as that analyzer is enforcing itself virally. When coupled with warn as error, this is a difficult problem to work around.

[davkean]

This is hit/referred to in these other issues:

https://github.com/aspnet/AspNetCore/issues/11935
https://github.com/aspnet/EntityFrameworkCore/issues/18618
https://github.com/dotnet/roslyn/issues/26222
https://github.com/Particular/NServiceBus.AmazonSQS/pull/185

[nguerrera]

Still blocked by NuGet/Home#6279