Replace Legal module with ECA

Thanks for your proposal @Youcanlearnit, I can certainly hear you about the issues with the legal module. We're facing such issues with that module as well, but with some patches, we got it working in D9, not on D10 yet, though.

Replacing it with ECA is tempting. On the other hand, I wouldn't underestimate the complexity. Not only is an audit required, such that the site owner can prove at any time, who accepted which version of the terms when and from which IP. What's more difficult, is the session handling and making sure that a user has no access to internal content and/or functionality before they haven't accepted the terms. The main problem is that we can only act when a user has logged in. At that point, they have a valid session and nothing prevents them from navigating to any of the places on the site that they have access to, and ignoring the form that requests their acceptance of the terms.

To prevent that from happening, ECA would have to check for each page request, whether the user has accepted the latest terms and if not, continue to redirect them to the same form over and over again. That verification would have to happen for every page request for every user forever. That may cause performance issues on top of all the other concerns.

As much as I'd like to use ECA for that, is it the best tool for that task?