Deprecate node_access_grants() and move its functionality to NodeAccessControlHandler

Problem/Motivation

There is a good bit of spaghetti code happening in the node access API. In particular, the declaration of grant realms and node access record implementations is tightly coupled -- i.e. node access module usually will need both hook_node_grants() and hook_node_access_records(). However, the actual functionality is still scattered between node.module (from D7 and before) and the Drupal 8 node and entity access control API implementation in NodeAccessControlHandler. In particular, the invocation of hook_node_grants() is in one place (in node_access_grants()) while the invocation of hook_node_access_records() is in the other.

This leads to a situation where it's difficult to find everything a developer needs to "know" to understand the node access system in D8.

Proposed resolution

1. Move the functionality of node_access_grants() onto NodeAccessControlHandlerInterface and into NodeAccessControlHandler.
2. Deprecate node_access_grants() and make it a wrapper for the new method.
3. While we're at it, or as a followup, give the new method and corresponding hook a name that's more accurate. hook_node_grants() does not provide grants; it provides grant realms. The actual access grants are provided in hook_node_access_records and other parts of the API including hook_node_grants(), various node permissions, etc.

This is probably not a prioritized change for 8.1.x, unlike #2473021: Deprecate NodeAccessControlHandlerInterface::writeGrants() for removal in Drupal 9.0.x → . We can improve it while retaining BC, so it can go into 8.1.x.

Remaining tasks

A later followup (not in scope here) would be to remove hook_node_grants() entirely as the grant realm declarations are more "info hook" than hook, so node access implementations might make more sense as plugins.

User interface changes

None.

API changes

TBD.