Using URL query parameters on JSON API routes disallowed by the JSON API spec now result in "400: Bad Request" responses

The JSON API spec states:

If a server encounters a query parameter that does not follow the naming conventions above, and the server does not know how to process it as a query parameter from this specification, it MUST return 400 Bad Request.

For more info, see: http://jsonapi.org/format/#query-parameters

JSON API 8.x-1.x

GET /jsonapi/…?foo=bar
GET /jsonapi/…?_foo=bar

results in a 2xx response.

JSON API 8.x-2.x

GET /jsonapi/…?foo=bar
GET /jsonapi/…?_foo=bar

results in a 400 response, because the JSON API spec reserves the foo parameter according to its naming conventions.

See http://jsonapi.org/format/#query-parameters for details.

Note: Until #2977600: Spec Compliance: `_format` is a disallowed query parameter name lands, he sole exception is ?_format=api_json, because Drupal core uses this. We're looking into disabling that too.