Promote justinrainbow/json-schema from dev-dependency to full dependency

We last moved two dependencies from require-dev to require in #3395586: Add Symfony's Filesystem and Finder components to core. The dependency evaluations happened in #3369121: Promote symfony/filesystem from dev-dependency to full dependency and #3369120: Promote symfony/finder from dev-dependency to full dependency.

https://github.com/justinrainbow/json-schema is a well-maintained package with >200 million downloads. It was added as a dev dependency >5 years ago, in #2843147: Add JSON:API to core as a stable module.

Landing this would unblock #3352063: Allow schema references in Single Directory Component prop schemas, which in turn would unblock the Drupal ecosystem to do very interesting new things on top of SDC, especially now that SDC is stable in 10.3!.

We already can see some of the cool things that enables in the ui_patterns module's 2.0.x branch, see #3352063-17: Allow schema references in Single Directory Component prop schemas for an explanation. The way they get around this issue not having landed yet is … by making their contrib module require justinrainbow/json-schema as a non-dev dependency! 😄

Making this a non-dev dependency means that we need to do a fuller evaluation of the security policies of justinrainbow/json-schema and it's dependencies. What's interesting is that master branch has more dependencies than the version we are currently on. It looks like people are trying revive the library a bit but we do need to think about the possibility of adding marc-mabe/php-enum and icecave/parity. It would be great to reach out the current library maintainers to see if they still plan to add these dependencies to the next version. I think we do need some idea about where the library is going and who is doing the maintaining going forward.

We will need to add this to https://www.drupal.org/about/core/policies/core-dependency-policies-and-... so we will need:
Repository link, release cycle info, security policy info, security issue reporting and contact details

An additional concern here is this we probably want to add a hook requirements to jsonapi module that warns when asserts are on because asserts + this package in production adds a lot of performance overhead to json API requests (yes I have seen this while auditing 'slow' sites)

FYI: the current version of justinrainbow/json-schema (version 5.x) has severe bugs that have been fixed in 6.x:

Create an SDC with this as the schema of one of its props:

      properties:
        src:
          title: "Image URL"
          type: string
          format: uri-reference
          pattern: "^(/|https?://)?.*\\.(png|gif|jpg|jpeg|webp)(\\?.*)?(#.*)?$"

This is valid per https://json-schema.org/understanding-json-schema/reference/regular_expr....

But it triggers a InvalidComponentException: [props.properties.image.properties.src.pattern] Invalid regex format ^(/|https?://)?.*\.(png|gif|jpg|jpeg|webp)(\?.*)?(#.*)?$ !

Turns out it's due to a bug that's been fixed years ago: https://github.com/jsonrainbow/json-schema/issues/508.

(More detail: #3515074-5: Shape matching MUST work with the resolved equivalents of $refs AND must be compatible with core's upcoming $ref resolving in SDCs.)

#7 would be solved by #3472008: Avoid JSON:API schema validation by default when assert is enabled

Adding #3499279: Make link widget autocomplete work (for uri and uri-reference props) which also requires the 6.3.1 version - the fix in https://github.com/jsonrainbow/json-schema/pull/800 is needed to support entity:node/3 style URIs in experience builder

Added #3516348: Allow 6.x version of justinrainbow/json-schema for adding support for both 5.x and 6.x at the same time

is this still needed?

it is still needed by #3352063: Allow schema references in Single Directory Component prop schemas on which I am currently working on.

A commit addressing the current issue has been pushed in the MR of the other issue: https://git.drupalcode.org/project/drupal/-/merge_requests/13457/commits

#3516348: Allow 6.x version of justinrainbow/json-schema was about version management. This issue is about moving dependency out of dev.

#13++

It would also benefit Canvas, because https://git.drupalcode.org/project/canvas/-/blob/1.x/composer.json?ref_t... has this as a full dependency too, and in fact the SOLE non-core dependency:

    …
    "require": {
        "drupal/core": "^11.2",
        "justinrainbow/json-schema": "^6.3"
    },
    …

Discussed with @alexpott & @catch at DrupalCon.

I forgot the process, and e.g. #3369120: Promote symfony/finder from dev-dependency to full dependency didn't document it either, so I think it's

composer require justinrainbow/json-schema "^5.2 || ^6.5.2" -W

So created an MR for that!

Added the dependency evaluation.

But basically: if it's good enough for Composer, surely it also is for us? 😅

Reviewed OK because similar to what was done in https://git.drupalcode.org/project/drupal/-/merge_requests/13457/commits

Discussed this with @Wim Leers, @pdureau and others at DrupalCon - the improvements in the library since this issue was original opened are very encouraging, and we have a very clear use case in the schema reference support.

I think we need an explicit followup for #3365985: Promote justinrainbow/json-schema from dev-dependency to full dependency so it doesn't get lost and then rediscovered by a website. Asserts should be off in production anyway? Maybe we can add a generic status report warning for them when 'dev mode' isn't enabled?

@catch I think #3472008: Avoid JSON:API schema validation by default when assert is enabled is a good enough followup already?

#22++

I cannot possibly express how strongly I agree with @catch's Asserts should be off in production anyway? 😅, so was bold and rescoped/retitled #3472008 in #3472008-22: Avoid JSON:API schema validation by default when assert is enabled 😇

EDIT: also, I think #3478689 becomes now more important too, as @longwave noted at #3478689-4: Investigate if ComponentValidator should have soft dependency on justinrainbow/json-schema.

BTW, any reason why we can't drop justinrainbow/json-schema's ^5.2 support? 😇 Especially given that that branch is barely maintained?