Escape at render, not in sources (rely on Twig autoescape)

Problem/Motivation

The string normalization change shipped in 2.0.17 (SA-CONTRIB-2026-075) escapes values in the source and prop-type normalize() layer, instead of leaving escaping to the render layer. Components are Twig templates and Twig autoescapes output by default, so {{ prop }} is already safe unless the value is a MarkupInterface. Escaping again by hand and then wrapping the result in Markup::create() (to stop Twig re-escaping) re-does what Twig already does. It is a no-op when it works, and it breaks rendering when it does not.

This one root cause produces several separately reported bugs:

- #3610847: Menu link titles and field labels double-escaped (normalize() is not idempotent): normalization runs in the source and again at render, and hand-escaping is not idempotent, so an ampersand is escaped more than once. A menu link titled "Aufenthalt & Besuch" then shows a literal & where the ampersand should be. Field labels are pre-normalized the same way.
- #3610520: NumberPropType doesn't work with Markup values.: a decimal field value is a string type, so the field-property source wraps it in Markup before it reaches the number prop. NumberPropType::normalize() then does (float) $value on a Markup object, giving "Object of class Drupal\Core\Render\Markup could not be converted to float" and the wrong value 1.
- url props break. A query string double-encodes (?a=1&b=2 renders as a broken a=1&b=2), and a route value becomes a fatal error. A link field set to <nolink> is escaped to route:<nolink>, and resolving that URL throws RouteNotFoundException: Route "&lt" does not exist.

The original XSS was itself an instance of the same mistake: a Markup::create() on unescaped user input, which marks it safe and tells Twig not to escape it. The right lever is to not mark untrusted values safe, not to hand-escape them first.

Verified: rendered through the real pipeline, {{ prop }} gives byte-identical output for a plain string and for Markup::create(Html::escape($x)). They differ only under {{ prop|raw }}, and there the template author is explicitly asking for raw HTML. Not honoring |raw would arguably be a bug in itself.

Steps to reproduce

Double-escaping (#3610847: Menu link titles and field labels double-escaped (normalize() is not idempotent)):
1. Create a menu link whose title contains an ampersand, e.g. "Aufenthalt & Besuch".
2. Render it through a component that maps the menu to a links prop (or a field label with an ampersand to a string prop).
3. The title shows a literal & instead of an ampersand.

Number prop (#3610520: NumberPropType doesn't work with Markup values.):
1. Add a decimal field to a content type and give it a value, e.g. 1.5.
2. Map that field to a number prop via the field-property source.
3. The page logs "Object of class Drupal\Core\Render\Markup could not be converted to float" and renders 1 instead of 1.5.

url prop fatal error:
1. Take a core Link field. Show it with the "Component per item" formatter as, say, ui_suite_bootstrap:button, mapping the field URI to the url prop.
2. Set the link to <nolink> (or <button>, or <none>).
3. Open the page: fatal error. This hits stock ui_suite_bootstrap components (button, dropdown, list_group_item). A query-string URL on a url prop shows the double-encoding without the fatal error.

Proposed resolution

Escape at the render layer, not in the source or in normalize().

- Keep Markup::create() only for values that are genuinely safe: a MarkupInterface, or a render array rendered through Drupal's safe-HTML pipeline. Leave plain strings as plain strings so Twig autoescapes them once at render.
- Drop the escaping and Markup wrapping in the sources (FieldPropertySource, TokenSource string/URL branch, FieldLabelSource) and in StringPropType/LinksPropType. Sources return the raw value; the prop type decides trust and Twig escapes.
- Honor |raw as the template author's explicit opt-out, consistent with standard Twig.

The parts of the 2.0.17 fix that already sit at the right layer stay: SlotPropType routing a plain string through #plain_text (core escapes it), and the TwigExtension::include() override that returns trusted markup for nested developer-authored components.

Remaining tasks

todo

User interface changes

None

API changes

None

Data model changes

None.