Don't try to set non-metadata properties on update

Hm, that would be an API change. Currently we explicitly require that the properties of an entity are known to not allow arbitrary data (a kind of safe guard). This is also some kind of validation so that the sender can be sure that the data matches what Drupal can process.

Why can't you use hook_entity_property_info() or hook_entity_property_info_alter() to register your custom properties?

So if we want to support use cases where it is allowed to pass unknown properties we also need to change the create operation.
What are the implications of this? Is it a security issue if we allow random data properties on our entity objects? We do have a permission for each resource/entity, so we might just acknowledge that users with that permission can do harmful stuff anyway.

The create method does some extra checks after entity_property_values_create_entity(), so we would have to remove that.

I talked to fago about this and he also said that we should keep the validation of entity properties. RESTWS provides a well-defined interface building on the entity property API, accepting data that violates the service contract makes it intransparent what is happening.

If you want to do that I would recommend to create a class MyentityRestWSResourceController extends RestWSEntityResourceController where you overwrite the update() method. Use hook_restws_resource_info_alter() to register your custom class and you should be done.