Wildcard path translator replaces the entity resolver’s 403 with a 500

Problem/Motivation

WildcardPathTranslatorSubscriber builds the matched route's URL with no parameters. On any route that needs a parameter this raises an exception, and translate-path answers with a 500 "Unable to build route URL".

This hides the correct answer. For a node the visitor cannot view, Decoupled Router's entity resolver answers 403, and the wildcard subscriber then replaces that with the 500. A user path such as /user/2 also gets the 500. The response holds only the error message, so the node stays private.

Reproduced on Drupal 11.4.11 with Druxt 1.3.1 and Decoupled Router 2.0.7.

Steps to reproduce

1. Install Druxt on a clean site, and create an unpublished node with the alias /unpublished-probe.
2. As an anonymous user, request /router/translate-path?path=/unpublished-probe, with _format=json added.
3. The response is a 500. It should be a 403 with "Access denied for entity."

Proposed resolution

• Leave any path that carries an entity to the entity resolver, including a path that names an entity that does not exist, such as /user/999.
• Rebuild any other route with the values from the path, so a link to reset a password works. If a route still cannot be built, this subscriber doesn't answer, and it doesn't raise an error.
• Subscribe at priority -100, so that this subscriber runs after every other resolver. Service order decides this now.

Remaining tasks

Review.

User interface changes

None.

API changes

None. The subscriber's priority changes, which matters only to a subscriber that runs below priority 0.

Data model changes

None.