C#: ASP.NET Controller is allowed to be abstract.

[michaelnebel]

In this PR we remove the restriction that a controller should be instantiable (this was introduced as a part of #9406).
Even though the documentation states that controllers should be instantiable then from an analysis perspective it makes sense to include abstract controllers as we are mostly interested in parameters (as remote sources) and methods (action methods) on controllers, which can easily be exposed to a user as the following example shows

public abstract class AbstractController : Controller {
    public void ActionMethod(string userInput) { sink(userInput); }
}

public class ConcreteController : AbstractController { }

[michaelnebel]

DCA looks good.