JSON:API spec requires 409 conflict for type errors on POST and PATCH

Problem/Motivation

The JSON:API spec states:

A server MUST return 409 Conflict when processing a POST request in which the resource object’s type is not among the type(s) that constitute the collection represented by the endpoint. Source

And:

A server MUST return 409 Conflict when processing a PATCH request in which the resource object’s type or id do not match the server’s endpoint. Source

However, JsonApiDocumentTopLevelNormalizer::validateRequestBody() checks that a request body includes a "type" member but does not check that the value matches the resource type of the requested endpoint. The type can be an arbitrary string. This is a spec violation.

Types are already checked for relationships.

Steps to reproduce

1. Enable JSON:API on a standard content entity, e.g. node.
2. POST to /jsonapi/node/article with a valid attributes payload but set data.type to an unrelated/invalid string, e.g. "type": "not-a-real-resource-type".
3. The request succeeds and the node is created, but it should fail because the type does not match.

Proposed resolution

validateRequestBody() now compares data.type to the resource type of the endpoint. A mismatch triggers a 409 Conflict response, per the JSON:API spec. The check runs for both POST and PATCH, since both operations call the same denormalize() method.

Test coverage

A kernel test exercises the denormalizer directly with a mismatched type. Functional tests send a mismatched type on POST and on PATCH and assert a 409 response with the expected error message.