Remove all @deprecated code from Drupal/Core/Access/

This is covered in #3104307: Remove BC layers in various Drupal\Core components but it might be easier to break that down into multiple patches, not sure

1. +++ b/core/lib/Drupal/Core/Access/CsrfRequestHeaderAccessCheck.php
   @@ -53,8 +53,6 @@ public function applies(Route $route) {
        $applicable_requirements = [
          '_csrf_request_header_token',
   -      // @todo Remove _access_rest_csrf in Drupal 9.0.0.
   -      '_access_rest_csrf',
        ];
   

   This probably doesn't need to be an array now it only has one item.

2. +++ b/core/modules/system/tests/src/Functional/CsrfRequestHeaderTest.php
   @@ -27,8 +27,7 @@ class CsrfRequestHeaderTest extends BrowserTestBase {
   +   * This checks one route that uses _csrf_request_header_token.
   

   This comment can be removed now, it's not helpful any more.

It is much simpler to just say this than use array_intersect() on an array with one item:

if (isset($requirements['_csrf_request_header_token'])) {

+++ b/core/lib/Drupal/Core/Access/AccessResult.php
@@ -278,37 +278,6 @@ public function cachePerUser() {
-  public function cacheUntilEntityChanges(EntityInterface $entity) {
-    return $this->addCacheableDependency($entity);
-  }

This never used trigger_error() or had a test, are we still OK to remove it?

edit: it is used in contrib: http://grep.xnddx.ru/search?text=cacheUntilEntityChanges&filename=

_access_rest_csrf was never properly deprecated either and contrib still refers to that too: http://grep.xnddx.ru/search?text=_access_rest_csrf&filename=

As per @Wim Leers in #3104307-16: Remove BC layers in various Drupal\Core components we must properly deprecate cacheUntilEntityChanges() and _access_rest_csrf for removal in D10 rather than removing them now in D9.

Lets check with @catch on that before changing the patch. They have been deprecated for a long time and at least for cacheUntilEntityChanges(), that was fairly visible and drupal-check should be able to report that, the route access check might be different.

We've removed other things without @trigger_error() too.

And for example at least one of the found usages of _access_rest_csrf is already broken anyway, because it doesn't define that on a route but checks for it on routes, so that's not going to show that output anymore, the BC layer can't work in that direction.

So I would say ::cacheUntilEntityChanges() is definitely fine to remove. It has @deprecated and a change record. For example it shows up here #3042605: Drupal 9 Deprecated Code Report.

I'm less sure about _access_rest_csrf because there's no way to inform people otherwise, I think we should take that out of the patch and discuss it in a follow-up. Also the runtime support for it is one or two lines.

In both cases we'll need 8.8/8.9 patches to make the deprecation up to current standards - can be separate issues to this one.

Opened #3111504: Properly deprecate AccessResult::cacheUntilEntityChanges() and #3111506: Properly deprecate _access_rest_csrf route requirement

Removed _access_rest_csrf changes from the patch. No interdiff as the patch is smaller than the interdiff itself.

Thanks. This now matches what is in #3104307: Remove BC layers in various Drupal\Core components but that was always meant to deal with leftovers and needs more work and what's done is done.

Committed 9f83de2 and pushed to 9.0.x. Thanks!

Thanks for opening the spin-offs, committed #3111504: Properly deprecate AccessResult::cacheUntilEntityChanges() to 8.9.x and 8.8.x just before this one.

Nice work here! :)