Use Entity API query access handler to filter entity queries based on user permissions

Last week I opened #3415653: [META] Allow more granular access on default farmOS Views → , having forgotten that @paul121 already opened this one. I closed mine as a duplicate, but now that I think about it, we may want to have both of them. This one is suggesting a specific solution to the problem, but in chat there were some other solutions proposed, both short term and long term. They have advantages and disadvantages, so I'm going to reopen my issue and repurpose it as a [META] issue to document all of the possibilities. This one can be a feature request specifically for the "query access handler" approach. I will tweak the title of this to make that more explicit, and make this a child of the [META] issue.

@paul121 if I've misrepresented anything please feel free to adjust! I will document some of our recent discussions in the [META] issue comments.

I propose we create a new permission access {entity_type} collection

Important note about the backwards compatibility considerations of this:

In discussing this further, we realized that changing the permission on Views may actually be a breaking change, though. If any downstream users have created roles that grant the view any {entity_type} permission in order to see the default Views, and we start requiring a different permission (access {entity_type} collection), users with those roles won't be able to see the default Views.

To address this, we could consider adding an update hook that automatically adds the access {entity_type} collection permission(s) to any roles that have the corresponding view any {entity_type} permission(s). I *think* that would be safe, but we should give that some dedicated thought.

From https://www.drupal.org/project/farm/issues/3415653#comment-15411481 →

Started a 3.x-query-access-handler branch and pushed to a new issue fork: https://git.drupalcode.org/issue/farm-3413263/-/compare/3.x...3.x-query-...

We still need to add the new permissions, with an update hook to add them to roles, etc. I wonder if we should tackle that in a separate PR and leave this just focused on enabling the query access handler?

Actually we should do this at the same time as the Log module (see 🐛 Use Entity API query_access handler Needs review ), and make sure we use the new version, so that all our entities get the access checking together.

Postponing this. Let's get it merged in Log first, then include a composer.json change to bump the drupal/log version constraint accordingly in this branch.