Audit all @todos

#2955615: Field properties are not being denormalized introduced this:

    // @todo Make this unconditional once https://www.drupal.org/project/drupal/issues/2957385 lands — JSON:API fixed denormalization of properties in https://www.drupal.org/project/jsonapi/issues/2955615, core's Serialization module still has to follow
    if ($test_module === 'jsonapi_test_field_type') {
      $this->assertSame(static::VALUE_ORIGINAL, $denormalized_entity->field_test->value);
    }

#2957385: FieldItemNormalizer never calls @DataType-level normalizer service' ::denormalize() method landed yesterday, so we can get rid of that todo! 🎉 Except we can't, because that only landed in 8.7, and JSON:API 2 supports 8.5 + 8.6 + 8.7. So, did that in #3015325-21: [ignore] support issue for the core patch.

Improved a whole bunch of them.

Created a new core issue for one of the @todos: #3028967: Queries across storages fail with very confusing exception.

Based on re-reading the issue (#2958587: Unable to filter on columns of entity reference fields) that introduced this particular @todo, I think this is actually unnecessary now.

Created another core issue: #3028976: Enable an entity query's return value to carry cacheability, for another @todo.

#2949021: Deprecate schema fallback in ConfigEntityType::getPropertiesToExport landed, so we can update its @todo.

Yay, found the first @todo whose blocker landed, we just forgot to do it!

Actually, lots of occurrences of the pattern in #8! Let's fix them all. These were blocked on #2939810: EntityResource::patchIndividual() should allow fields that the user is not allowed to change, as long as they match the current value, and that issue should've fixed these, but it didn't. 😅

Similarly, #2934149: [>=8.5] JSON API routes not specifying _content_type_format route requirement, resulting in bad DX landed, but it only solved the @todo for the PATCH case, not the one for the POST case. Fixed.

Again similarly, #2543726: Make $term->parent behave like any other entity reference field, to fix REST and Migrate support and de-customize its Views integration was fixed, but the @todo wasn't updated. Sadly, that only landed in 8.6, and since JSON:API still supports 8.5, we'll just need to make it run conditionally now. Still, that's a step forward :)

Also, the above patches didn't apply because I still had #3015325: [ignore] support issue for the core patch applied while creating these patches. Sorry about that.

Again similarly, #2956084: Impossible to raise an error when an `include` is requested for an inaccessible relationship field. was fixed, but its @todo hadn't been removed.

A few trivial fixes and one CS fix.

Another one, this time for #2929428: [>=8.5] Convert "throw new *HttpException" into "throw new Cacheable*HttpException" where possible.

Progress. Still fails though, now on expected cache contexts instead of cache tags.

Note that unlike #18, this is now also asserting the body!

Dealing with the cache contexts here is A) out-of-scope, B) blocked on other issues. Enabling the majority of that test coverage still is a big step forward.

While working on #21, I think I observed a lengthy override to be unnecessary. Let's see.

Signing off for today. @gabesullice, feel free to continue in the mean time. I haven't yet figured out where the Drupal 8.5 failure was introduced.

Thanks Gabe! Picking this up again :)

I queued PHP 5.6/Drupal 8.5 tests for all patches, since that's failing in #25. Turns out it's also failing on HEAD: https://www.drupal.org/pift-ci-job/1184958. So … that's not introduced here. Still, here's an attempt to fix that.

#2939810: EntityResource::patchIndividual() should allow fields that the user is not allowed to change, as long as they match the current value was also fixed without two @todos getting resolved. Fixed.

Adding all mentioned issues as related issues.

In a few cases, the patch was able to address the @todo but had to introduce a more narrowly scoped new one that is blocked on something more specific. Adding those as related issues too.

Fix CS violation.

Apparently the Comment entity's validation order changed in Drupal 8.7. Working around that.

#18 was incomplete, there was one more @todo for #2929428: [>=8.5] Convert "throw new *HttpException" into "throw new Cacheable*HttpException" where possible.

#41 was insufficient to prevent multiple identical fieldsets from being tested, any non-first request would result in a cache hit of course.

And there were some quite obvious simplifications that I refrained from doing earlier: explicit asserts that are part of the now uncommented assertResourceResponse(…) call 👍

1. Before patch: 144 @todos in .php files
   After patch: 128 @todos in .php files
2. The majority of @todos refer to #2300677: JSON:API POST/PATCH support for fully validatable config entities (~80). Many @todos are about 8.5/8.6 work-arounds, that are removed in #3015325: [ignore] support issue for the core patch (that currently removes 21 @todos).
3. #2965056: Support `include` parameter on relationship routes (turns out it accidentally works on cold caches: fix + test this) is ready too now, and it removes 2 @todo that I would have to address here otherwise in a less-than-ideal way.
4. #2965056 + #3015325 brings us down to 108 @todos of which ~80 are about config entities, ~5 are about PHP 5.x limitations, and the remainder are mostly long-standing core bugs. I think

Conclusion: this patch is a big leap forward: 14 files changed, 109 insertions, 313 deletions. Green on Drupal 8.5+8.6+8.7 and PHP 5+7. Let's do this! 🚢