Create a custom EntityAccessDeniedHttpException

Thanks @dawehner! This is definitely the path we want to move this forward.

Some comments.

1. +++ b/src/Controller/EntityResource.php
   @@ -117,7 +119,15 @@ class EntityResource {
   +      $exception = new EntityAccessDeniedHttpException(403, 'The current user is not allowed to GET the selected resource.');
   

   The new statements do not match the class constructor arguments.

2. +++ b/src/Controller/EntityResource.php
   @@ -117,7 +119,15 @@ class EntityResource {
   +      if ($entity_access instanceof AccessResultReasonInterface) {
   +        $exception->addError($entity, '/data', $entity_access->getReason());
   +      }
   +      else {
   +        $exception->addError($entity, '/data');
   +      }
   

   There seems to be quite some duplication around this code.

   What if we had a static method in EntityAccessDeniedHttpException that did all this?

   Something like:

   public static function create($message, $entity, $pointer, $access = NULL) {
     …
   }
   

   In that scenario we could turn addError into a protected method to reduce API surface.

3. +++ b/src/Error/EntityAccessDeniedHttpException.php
   @@ -0,0 +1,63 @@
   +   * UnprocessableHttpEntityException constructor.
   

   Copy & Pasta

4. +++ b/src/Error/EntityAccessDeniedHttpException.php
   @@ -0,0 +1,63 @@
   +    $this->entities[] = $entity;
   +    $this->pointers[] = $pointer;
   +    $this->reasons[] = $reason;
   

   This approach seems a bit brittle. Why not an array of errors keyed by entity ID.

   $this->errors[$entity->id()] = [
     'entity' => $entity,
     'pointer' => $pointer,
     'entity' => $reason,
   ];
   

   That way the arrays cannot get out of sync with each other.

5. +++ b/src/Error/EntityAccessDeniedHttpException.php
   @@ -0,0 +1,63 @@
   +    return $this;
   

   What's the gain on returning self instead of not returning?

+++ b/src/Normalizer/EntityAccessDeniedHttpExceptionNormalizer.php
@@ -0,0 +1,46 @@
+    if ($exception instanceof EntityAccessDeniedHttpException) {

This should be enforced by protected $supportedInterfaceOrClass = EntityAccessDeniedHttpException::class;. However I'm good keeping this in case anyone changes the applies logic when extending this.

Assigning to myself to add a test for a collection that includes 403. I also did a needed reroll.

Changes:

• Added the resource name to the error ID to identify the entity that failed more easily.
• Included the 403 inside of collections and patching relationships.
• Fixed some JSON pointers.
• Added an extra assertion for the collections 403s.

Ugh! I sent the interdiff with the wrong extension. Now the testbot is going to choke. Is there any way to cancel a queued test?