Xcode-style build setting macros are not properly blocked at package loading time

[jakepetroules]

Is it reproducible with SwiftPM command-line tools: swift build, swift test, swift package etc?

• Confirmed reproduction steps with SwiftPM CLI. The description text must include reproduction steps with either of command-line SwiftPM commands, swift build, swift test, swift package etc.

Description

The manifest loader has the following code to block Xcode-style build setting macros from being referenced in package manifest properties:

/// Looks for Xcode-style build setting macros "$()".
fileprivate static let invalidValueRegex = try! RegEx(pattern: #"(\$\(.*?\))"#)

However, this is insufficient, as Swift Build allows $(X), ${X} and $X syntax to expand build setting references. We should make this check more robust as we transition to Swift Build being the SPM build engine backend.

Expected behavior

No response

Actual behavior

No response

Steps to reproduce

No response

Swift Package Manager version/commit hash

No response

Swift & OS version (output of swift --version ; uname -a)

No response