Change Dynamic Page Cache's response policy from "deny admin routes" to "deny html admin routes"

Problem/Motivation

• #2827797: ResourceResponse(Subscriber) + Dynamic Page Cache: making authenticated ResourceResponses significantly faster surfaced that there are REST routes (such as GET requests for Shortcut and MenuLinkContent entities) that are marked as administrative routes (_admin_route) by virtue of starting with an /admin URL path, and that this excludes those resources from benefiting from Dynamic Page Cache due to the dynamic_page_cache_deny_admin_routes response policy.
• #2874938: AdminRouteSubscriber must only mark HTML routes as administrative is the issue for deciding what we mean by "administrative" for non-HTML routes, and potentially not marking REST routes as administrative.
• Regardless of that issue, it might make sense to change dynamic_page_cache_deny_admin_routes to a policy that's just scoped to denying caching HTML admin routes, since the reasons for that policy might not apply to non-HTML routes. This issue is for discussing and implementing such a change.

Background

• The Dynamic Page Cache module was developed in #2429617: Make D8 2x as fast: Dynamic Page Cache: context-dependent page caching (for *all* users!). For most of that issue's lifetime, it included a policy to deny caching of admin routes due to a concern that throughout core and contrib, there would exist admin routes for which cacheability metadata was lacking due to developer omission, and that therefore caching such routes would result in stale content being served, which in some cases could also be a security bug. This concern, among others, was discussed in #2556889: [policy, no patch] Decide if SmartCache is still in scope for 8.0 and whether remaining risks require additional mitigation, where the policy of denying caching of administrative routes was included as one of several risk mitigation strategies.
• On the day that Dynamic Page Cache was committed to core, the PHPDoc explaining the policy was changed from:
  

  This policy rule denies caching of responses generated for admin routes, because the cacheability metadata of most admin route responses is lacking, which would lead to stale content being shown and the site being perceived as broken.

  to
  

  This policy rule denies caching of responses generated for admin routes, because admin routes have very low cache hit ratios due to low traffic and form submissions."

  which remains the PHPDoc in the Drupal\dynamic_page_cache\PageCache\ResponsePolicy\DenyAdminRoutes class today.

• If the reason for the policy is what is currently stated in the PHPDoc, then that reason does not automatically apply to non-HTML routes. URLs that might have low hit ratios for HTML usage might have high hit ratios for REST usage. For example, GET requests of MenuLinkContent entities.
• If the reason for the policy is what was originally stated in the PHPDoc prior to that patch's commit, then that might also not apply to non-HTML routes. Creating non-HTML routes is less commonplace than creating HTML routes, so it might be reasonable to expect developers who do so to bear the responsibility of providing cacheability metadata.

Proposed resolution

Change the default policy of dynamic_page_cache module to be scoped to only denying HTML admin routes. For BC, in order to make it easy for sites to use the old policy, one possible implementation might be:

• Create a new policy, DenyHtmlAdminRoutes, to sit alongside the existing DenyAdminRoutes class.
• Mark DenyAdminRoutes as @deprecated.
• Remove (or comment out) dynamic_page_cache_deny_admin_routes from dynamic_page_cache.services.yml and add a dynamic_page_cache_deny_html_admin_routes instead.
• Provide a change record of this change and include instructions of how a site owner can modify their services.yml file to add back the old policy.

Remaining tasks

Discuss.

User interface changes

None.

API changes

No API change, but there is a behavior change per the proposed resolution.

Data model changes

None.