Add JSON:API test coverage for SA-CORE-2019-003

Ported the test coverage from the security issue. AFAICT @gabesullice and I worked on that security patch, so crediting him too.

I just realized that probably nobody is going to review and RTBC this since this originates from a private Drupal security issue.

Since this was a joint effort anyway, I'm RTBC'ing this, along with explanations to make it easier to grok for core committers:

1. +++ b/core/modules/jsonapi/tests/src/Functional/MenuLinkContentTest.php
   @@ -178,4 +181,56 @@ public function testCollectionFilterAccess() {
   +    $response = $this->request('POST', $url, $request_options);
   +    $this->assertResourceErrorResponse(500, (string) 'The generic FieldItemNormalizer cannot denormalize string values for "options" properties of the "link" field (field item class: Drupal\link\Plugin\Field\FieldType\LinkItem).', $url, $response);
   

   This is the essential security test coverage: it verifies that the insecure thing cannot happen anymore.

2. +++ b/core/modules/jsonapi/tests/src/Functional/MenuLinkContentTest.php
   @@ -178,4 +181,56 @@ public function testCollectionFilterAccess() {
   +    // Create a menu link content entity without the serialized property.
   +    unset($document['data']['attributes']['link']['options']);
   +    $request_options[RequestOptions::BODY] = Json::encode($document);
   +    $response = $this->request('POST', $url, $request_options);
   

   This ensures that it's still possible to create MenuLinkContent entities via JSON:API, just not with options.

3. +++ b/core/modules/jsonapi/tests/src/Functional/MenuLinkContentTest.php
   @@ -178,4 +181,56 @@ public function testCollectionFilterAccess() {
   +    // Ensure that the entity can be updated using a response document.
   +    $request_options[RequestOptions::BODY] = $response_body;
   +    $response = $this->request('PATCH', $url, $request_options);
   +    $this->assertResourceResponse(200, Json::decode($response_body), $response);
   

   And this verifies that it's possible to PATCH existing MenuLinkContent entities as long as you don't modify options.

Committed 39909ce and pushed to 8.8.x. Thanks!