A generated endpoint answers anybody holding the API switch, without its own permission

Problem/Motivation

A generated endpoint is meant to be closed until its own REST permission is granted, on top of "access myrest api". The route requirement is written as restful get <id>+access myrest api, and the comment beside it says the "+" means both. In Drupal's _permission requirement "+" means any; "all" is written with a comma. So every generated endpoint answers anybody who holds the API switch alone - on most sites the anonymous role. Measured on a development site: the generated listing of user accounts answered an anonymous request with 200 and the accounts, with no permission granted for it.

The test that was meant to hold this checks that the requirement string contains "+", which is exactly the bug.

Proposed resolution

• Join the two permissions with a comma, and correct the comment.
• Replace the string assertion with a functional test: an anonymous request with "access myrest api" alone gets 403 from a generated endpoint and 200 once its own permission is granted; an endpoint public by nature and a handwritten one still answer with the switch alone.
• Say in the release notes that generated endpoints were reachable with the API switch alone, and which sites should review their permissions.

Remaining tasks

Everything.