Audit cacheable metadata generation

IMHO we can close this because we:

1. now have extensive test coverage
2. have had a security release that fixed the problems uncovered by the test coverage

Thoughts?

Or perhaps this was intended to be more architectural, along the lines of the changes that #2940342: Cacheability metadata on an entity fields' properties is lost made?

At the present moment some metadata is generated during the response generation (on the EntityResource) and some is generated during the normalization process.

definitely suggests that.

In fact, that is essentially saying that we should be able to remove the executeInRenderContext() call in \Drupal\jsonapi\Controller\RequestHandler::handle(), which I could not agree more with. That's what I worked on in #2883086-43: [PP-1] Port RequestHandler + ResourceResponseSubscriber improvements from REST module to JSON API.

So, I worked on that in #2883086-43: [PP-1] Port RequestHandler + ResourceResponseSubscriber improvements from REST module to JSON API. I tried to drive it to completion, but you can see in #2883086-47: [PP-1] Port RequestHandler + ResourceResponseSubscriber improvements from REST module to JSON API that the scope was growing larger and larger, hence leading me beyond the purpose of that issue. The root cause was LinkManager, for which I created #2952714: Group module's GroupAccessResult::allowedIfHasGroupPermission(s)() does not include cacheability.

Once #2952714 is done, we will be at a point where no cacheability metadata is bubbled/collected outside of the normalization process!

Marking "PP-2": this is blocked on #2952714 and #2883086.

The IS currently contains this:

1. Determine if it's possible to have all the metadata centralized.
2. Do not output a cache tag for each individual entity in collections (probably coming from the normalizer).

The first point is covered by #8.

The second point does not make sense: if the data of a particular entity is listed, then its cache tag must be present too. Removed that from the IS.

1. #2952714: Group module's GroupAccessResult::allowedIfHasGroupPermission(s)() does not include cacheability and #2883086: [PP-1] Port RequestHandler + ResourceResponseSubscriber improvements from REST module to JSON API are done.
2. #2940342: Cacheability metadata on an entity fields' properties is lost made cacheability bubbling an order of magnitude more robust.
3. #2948666: Remove JSON API's use of $context['cacheable_metadata'] landed two days ago.
4. We have comprehensive test coverage now.

I think it's safe to consider this done :)