Access control to Personalization Segments

Although we're working on Personalization in parallel to trying to get a stable XB 1.0.0 released, the former is not a blocker to the latter. If Personalization itself isn't sufficiently stable by the time we're ready to release XB 1.0.0, we can put it behind a feature flag.

We need to tackle this before I expected, as by default the status=false won't be exposed via the APIs, and we need to ensure editors have access to them.

Provide an access control handler for personalization segments using our single permission “manage personalization”.

This was approved by @lauriii?

If so: 👍

Assigning to @lauriii for confirmation, even if we already have the permission in HEAD. This is about adding a access handler to the config entity (probably our existing VisibleWhenDisabledXbConfigEntityAccessControlHandler is more than enough)

@lauriii, see #8.

I think a single permission for managing the segments is sufficient. 👍

📌 Provide a locked Default segment Active is about to land and will already add the access control handler. So all that's missing then, is test coverage expansion.