[SENESO]

Fixes #66434 (also closes #69061 as a duplicate).

RateLimitingMiddleware creates its own PartitionedRateLimiter<HttpContext> (_endpointLimiter) in CreateEndpointLimiter() but never disposes it. The limiter's internal timer infrastructure keeps the host rooted, so every WebApplicationFactory-based test class leaks roughly one host (~100MB). Verified with a WeakReference repro: the host is not collectable with UseRateLimiter before this change, and collectable after.

The fix registers the middleware-owned limiter for disposal on IHostApplicationLifetime.ApplicationStopped. Design notes:

• Only _endpointLimiter is disposed — it is created inside the middleware, so the middleware is its sole owner. _globalLimiter comes from RateLimiterOptions.GlobalLimiter (user-provided) and is deliberately left alone: the user may share it across hosts or dispose it themselves.
• GetService (not GetRequiredService) keeps this null-safe for non-host scenarios; the callback is a static lambda so the registration can't root the middleware instance.

Tests:

• EndpointLimiterIsDisposedWhenApplicationStops — fails without the fix, passes with it.
• GlobalLimiterIsNotDisposedWhenApplicationStops — documents the ownership decision.

Note: I couldn't execute the repo's own test suite in my environment (it needs the source-built targeting pack from a near-full repo build), so CI is the real gate here. The change is minimal, additive, and null-safe.

[dotnet-policy-service]

Thanks for your PR, @SENESO. Someone from the team will get assigned to your PR shortly and we'll get it reviewed.

[SENESO]

@dotnet-policy-service agree