Accountform is missing an entity field access check for 'mail'

Thanks for working on this and for providing test coverage. The fix looks correct to me.

Based on #10, I think this needs a change record and a release note. (We typically provide release notes when we fix access control rules in a way that might require contrib or custom code, or site owners, to change access configuration.)

Savin credit for @idebr for the patch and for @Lendude for review.

Thanks!

Added a change record: https://www.drupal.org/node/3336695 →

Added a release note to the issue summary:

The user account form now applies entity field access to the 'Email address' field in line with other user account form fields. As a result, it is now possible to forbid accessing the 'Email address' field using hook_entity_field_access().

Change record and release notes have been added. Since this was previously RTBC and there has been no code change adding back.

Committed c490d4c and pushed to 10.1.x. Thanks!

Not backporting to 10.0.x or 9.5.x because of the potential disruption to custom code that is not taking into account that access is being checked for the mail field, but still want the mail field to be editable.

Automatically closed - issue fixed for 2 weeks with no activity.