Refs #19228

Summary

Implements the attribute-routing RFC from #19228 by introducing route attributes, wiring attribute discovery/connection into routing, and aligning controller action argument binding for named/positional route params.

This also extends AttributeResolver metadata so routing can make controller-instantiability and action-eligibility decisions without reflection in the connector layer.

What changed

• Added routing attributes for controller/action mapping:
  • Route, HTTP method shortcuts (Get, Post, Put, Patch, Delete, Options, Head)
  • class-level attributes: Scope, Prefix, RouteClass, Middleware, Extensions, Resource
• Added AttributeRouteConnector to:
  • aggregate class/method attribute metadata
  • connect method routes and resource routes
  • derive _argsByName metadata from pass/placeholders
  • skip non-instantiable controller targets via resolver metadata
  • ignore non-public method targets using resolver-provided method visibility metadata
• Added RouteBuilder::attributes() integration to connect resolver-discovered routes.
• Updated ControllerFactory to support _argsByName mapping while preserving existing positional/named pass behavior.
• Kept compatibility behavior for non-attribute routing (no strict route-placeholder vs action-signature exception by default).

AttributeResolver updates (and why)

• Extended AttributeTarget metadata with:
  • declaringClassType (class / interface / trait / enum)
  • isDeclaringClassAbstract
  • methodVisibility (public / protected / private, for method-related targets)
  • computed helpers: isInstantiableDeclaringType() and isPublicMethodTarget()
• Added MethodVisibility enum.
• Updated Parser to populate class-type/abstractness metadata once per class and method visibility once per method, then propagate into method/parameter targets.

Why this was needed:

• Routing must ignore abstract or non-class controller declarations.
• Routing should only connect public action methods.
• Centralizing this in resolver metadata removes connector reflection checks, keeps connector logic simpler, and makes metadata reusable for other consumers.

Forward-looking note

• The new methodVisibility metadata also opens a path for future “auto-scoped routes” mode, where all public controller methods inside a scope could be connected automatically without relying on fallback routing.

Usage examples (after setting up AttributeResolver)

// config/routes.php

$routes->connectAttributes();

$routes->scope('/', function (\Cake\Routing\RouteBuilder $routes): void {
   // Manual routes...
});

// src/Controller/ArticlesController.php
use Cake\Routing\Attribute\Get;
use Cake\Routing\Attribute\Scope;

#[Scope('/articles', namePrefix: 'articles:')]
class ArticlesController extends AppController
{
    #[Get('/', name: 'index')]
    public function index(): void
    {
    }

    #[Get('/{id}', name: 'view')]
    public function view(string $id): void
    {
    }
}

use Cake\Routing\Attribute\Resource;

#[Resource('articles', only: ['index', 'view'])]
class ArticlesController extends AppController
{
}