[Serializer] Fix unexpected allowed attributes

[mtarld]

Q	A
Branch?	5.4
Bug fix?	yes
New feature?	no
Deprecations?	no
Issues	Fix #52673 #49710
License	MIT

A more accurate approach than #52680

[mtarld]

fabbot errors aren't related to that PR.

[chalasr]

As discussed at SymfonyCon, the information (access type) would better transit through a method parameter than a context option since the need is specific to the abstract method at hand

[mtarld]

Once this PR will be upmerged to 7.1, I'll create a new one to trigger the proper deprecations.

[nicolas-grekas]

The implementation fits the definition of a new feature to me: adding an argument on a constructor, and adding an argument on public/protected methods.
This should come with an @param annotation for methods, and this will yield a new deprecation.
Maybe another approach is possible? I don't know at all :)

[chalasr]

That read/write mode do need to be passed throughout method calls to fix the bug at hand, so the plan here is to make it a parameter that's hidden at first on 5.4, then make it virtual on 7.1 and finally make it real on 8.0.
The only alternative I can think of is to put the info in $context instead.

@mtarld would that work conceptually and technically?

[mtarld]

It appears that it works indeed, and it is much better thanks!

I'm wondering if we should make that read/write information explicit in 7.1, maybe a context value like here is enough (but it is less secure).

[fabpot]

Thank you @mtarld.

[stloyd]

Those changes generate a big performance drop in one of the projects I work with where we extensively use attributes on DTOs.

Comparing Serializer in version 7.0.6 vs 7.0.7:

[nicolas-grekas]

Please open a dedicated issue if you want any follow up.