Create granular on a per plugin basis

I don't think we necessarily want to introduce additional permissions, but I can see a case for granular access control. I would suggest that we simply add \Drupal\Core\Access\AccessibleInterface to ProjectBrowserSourceInterface and allow plugins to implement their own access checking as desired.

The meaty question here is "when should access be checked?" When viewing sources at their own page, sure. When viewing a source in a mini-browser, yes. But what about when querying? Should the endpoints respect source-defined access controls? How should this interact with the activation system?