fix: #3612597 JsonApiDocumentTopLevelNormalizer::validateRequestBody() does...

Ben Stallingsrequested to merge
issue/drupal-3612597:3612597-jsonapidocumenttoplevelnormalizervalidaterequestbody-does-not into main

fix: #3612597 JsonApiDocumentTopLevelNormalizer::validateRequestBody() does not verify resource type on POST/PATCH

The "type" member of a JSON:API request body was only checked for presence, never compared against the resource type implied by the route, so any string was silently accepted. Reject mismatches with a 409 Conflict per the JSON:API spec, and fix two test fixtures whose placeholder "type" values only worked because of this bug.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

Closes #3612597

Merge request reports