Admin config overview shows links that the user cannot access

Steps to reproduce

1. log in as a user with the 'access administration pages' permission, but not 'administer image styles'
2. Visit /admin/config

Expected result

Only links that you have access to visit should be displayed

Actual result

Links you cannot access are displayed, but if you click them, you get an access denied message.

\Drupal\system\Controller\SystemController::overview does include a check that should prevent this - the commit message references #1805054: Cache localized, access filtered, URL resolved, and rendered menu trees →