CSRF links in a drupal_set_message don't render correctly

A test to reproduce this would make it much easier to work on this.

Here's a test :)

This reminds me of #2382667: #post_render_callback's that result from other #post_render_calback are not processed btw: recursion in placeholders (that issue I linked is from before placeholders were called placeholders).

#2478483: Introduce placeholders (#lazy_builder) to replace #post_render_cache then updated that test and moved it to \Drupal\Tests\Core\Render\RendererPlaceholdersTest::testRecursivePlaceholder().

That test is obviously passing, so it probably isn't this. Though it feels related.

So yeah, the problem is that we loose the attachments when rendering the links.
One thing we could do is

1. Expand FormattableMarkup with cacheable metadata
2. Make drupal_set_message() capable of storing that
3. Leverage those attachments when rendering the messages

@alexpott, @fabianx and @dawehner discussed that and well, drupal_set_message() supports render arrays, so we can add the required information on there:

$url = Url::fromRoute('meh')->toString(TRUE);

$build = [
  '#markup' => t('Meh @url', $url->getGeneratedUrl()),
];

CacheableMetadata::createFromObject($url)->applyTo($build);

just for this specific redirect.

The IMHO easier workaround is to use renderPlain() as I suggested. It works fine, the test was just broken and the user *actually* didn't have access to run cron ;)

I think we should change the placeholder to be more obvious, like 'render-placeholder:' . $hash, so you see what is actually going on.

Note that using Link in a translatable message is wrong anyway, the correct approach is to use run cron. But that won't change anything, the problem is that \Drupal\Core\Render\MetadataBubblingUrlGenerator::generateFromRoute() always passes TRUE. We would need to have a way to call the inner, non-bubbling url generator directly.

I also propose this as a duplicate of #2630920: _csrf_token is broken due to cacheability metadata integration, results in rendered links without valid CSRF tokens. This is exactly the same problem.

I also propose this as a duplicate of #2630920: _csrf_token is broken due to cacheability metadata integration, results in rendered links without valid CSRF tokens. This is exactly the same problem.