Access bypass in entity-reference selection handler if hook_entity_access is implemented

Problem/Motivation

This was originally reported as a private issue and the security team decided it could be handled in public

When there is an implementation of hook_entity_access this is not taken into account by entity reference selection handlers.

Steps to reproduce

1. Create a couple sample nodes.
2. Protect one of these nodes by implementing entity access hook like follows.
   

   /**
    * Implements hook_ENTITY_TYPE_access().
    */
   function HOOK_node_access(NodeInterface $node): AccessResultInterface {
     return AccessResult::forbiddenIf($node->id() == 1);
   }
   

3. Check that it works as expected
   /node/1 should return 403
   /node/2 should return 200
4. Create an entity reference field to content for some content type
5. Configure the select list widget for that field
6. Open "Add node" form for that content type
7. At this point you should be able to see the label of "protected" node in the select list

The issue also happens when autocompletion widget is used.

Proposed resolution

When there is no access to 'view label' for a result, show Node: 3 or similar - e.g. {Entity type label}: {Entity type id}

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet