fix: give the json:api detail of a publish-only refusal as plain text

Under publish_only, a refused publish is reported at /data as an entity violation, which core's JSON:API gives without decoding its HTML, so the detail carried ' and <br>. A kernel.exception subscriber that runs before JSON:API's rewrites only Vale's entity violations as plain text, one alert per line. JSON:API does not allow other normalizers. The proper fix belongs in core.