Use jsonapi to post a flagging needs permission 'administer flaggings' and always failed to "A flagging can't be moved to another entity."

Problem/Motivation

At present, flaggings cannot be posted or retrieved from jsonapi unless the user has the "Administer flaggings" permission.

This is incorrect behavior because users may have permission to make flaggings/access their own flags, so they shouldn't be automatically denied access.

According to Wim Leers → , the Flag module needs to provide a normalizer for rest/jsonapi.

Steps to reproduce

1. Create a flag and have authenticated users flag some content.
2. Use jsonapi to try to post a flagging while logged in as a non-admin user that has permission to post a flag.

You will get an "access denied" message.

Proposed resolution

Add support for POST operations for flags in jsonapi.

Remaining tasks

User interface changes

API changes

Data model changes